The WowStore – Store Builder & Product Blocks for WooCommerce plugin is vulnerable to SQL Injection via the ‘search’ parameter in all versions up to and including 4.4.3. The vulnerability results from insufficient escaping of the user-supplied value and lack of preparation on the existing SQL query, which enables an attacker to append additional SQL statements and retrieve sensitive database content. This flaw leads to potential data exposure of confidential information stored in the WordPress database.

WordPress sites that have installed the WowStore – Store Builder & Product Blocks for WooCommerce plugin, version 4.4.3 or earlier. The vendor identified the issue as affecting all releases up to 4.4.3.

The CVSS score of 7.5 indicates a high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that public exploitation has not yet been observed. The attack vector is unauthenticated, requiring only that an attacker knows the URL of a page that accepts the 'search' parameter or the REST API endpoint that processes it. Because the flaw is in the application logic rather than the web server, it can be exploited without special privileges, making it a convincing threat for attackers with limited resources.