This vulnerability is an SQL injection flaw (CWE-89) located in the subscriber management component of the YITH WooCommerce Membership Premium plugin. It allows an attacker to supply crafted input that is incorporated directly into SQL queries executed against the site’s database. The injected statements can read, modify, or delete data, thereby compromising the confidentiality, integrity, and availability of the e‑commerce environment. The description does not state whether authentication is required to exploit the flaw, so that detail remains unspecified.

All WordPress installations that use YITH WooCommerce Membership Premium plugin version 2.33.0 or earlier are affected. The vulnerability exists wherever the predecessor plugin has been deployed, regardless of whether the site is publicly accessible or the subscriber interface is restricted to certain user roles.

The CVSS score of 8.5 indicates high severity. The EPSS score of less than 1% suggests a very low but non‑zero probability that it will be actively exploited. It is not listed in the CISA KEV catalog. The likely attack path requires an attacker to issue requests to the subscriber‑management endpoints. It is not explicitly stated whether these endpoints are publicly accessible or require authentication; therefore, the attack could potentially be performed from a publicly reachable interface or, if restricted, would require valid credentials. Once access is achieved, the attacker can inject arbitrary SQL to read, modify, or delete data stored in the site’s database.