Subscriber SQL injection vulnerability allows attackers to execute arbitrary SQL statements through the plugin’s subscriber management interface. The flaw results from inadequate validation of user supplied parameters before they are incorporated into query strings. Successful exploitation could lead to data disclosure, modification, or deletion of database contents, thereby compromising confidentiality, integrity, and potentially availability of the e‑commerce site.

All installations of the YITH WooCommerce Membership Premium plugin with version 2.33.0 or earlier are vulnerable. These include any WordPress site using the YITH WooCommerce Membership Premium plugin not updated beyond 2.33.0.

The CVSS score of 8.5 indicates high severity. The EPSS score is not available, so exploitation probability is currently unknown but could be significant given the popularity of WordPress and WooCommerce. The vulnerability is not listed in the CISA KEV catalog, yet its SQL injection nature and potential for remote compromise suggest it could be targeted by attackers. The likely attack vector is the plugin’s subscriber interface, which is accessible to users with sufficient permissions, and may be reachable over the network if the WordPress installation is publicly exposed.