The flaw is an improper neutralization of special elements in an SQL command that allows an attacker to perform blind SQL injection against the YITH WooCommerce Product Add‑Ons plugin. An attacker can send crafted input to the plugin’s endpoints, causing the database to execute arbitrary SQL statements. This can lead to data exposure, modification, or deletion, compromising the confidentiality, integrity and availability of the store’s transactional data.

The vulnerability impacts the YITH WooCommerce Product Add‑Ons plugin for WordPress, affecting all installations from the first version up to and including 4.29.0. Versions 4.29.1 and later contain the fix.

With a CVSS score of 7.6 the vulnerability is considered high severity. The EPSS score is not available, so the current exploitation likelihood is unknown, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via web requests that the plugin processes, meaning an unauthenticated or low‑privileged attacker could trigger the injection if no input validation or parameterization is enforced. Once exploited, the attacker can exfiltrate sensitive customer data or alter order records, which directly threatens the store’s business operations.