This vulnerability arises from improper neutralization of special elements in an SQL command, allowing an attacker to perform blind SQL injection against the Pix por Piggly (para Woocommerce) plugin. By exploiting this weakness the attacker may read or modify sensitive information stored in the database, potentially revealing customer data or interfering with order processing. The flaw is classified as CWE-89 and represents a typical injection flaw that can be leveraged without authentication if the input is not properly sanitized.

The affected product is the WordPress plugin Pix por Piggly (para Woocommerce) from Piggly Dev. Versions from the earliest available release through 2.1.2 are vulnerable. No specific version numbers prior to 2.1.2 are listed, but the issue persists across the entire range up to and including 2.1.2.

The CVSS score of 7.6 categorizes the flaw as High severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that it may not have been widely exploited yet. The likely attack vector is remote, via web requests that supply unsanitized input to the plugin’s database queries. If an attacker can access a vulnerable endpoint, they can inject SQL fragments that return data through timing or other blind techniques, bypassing authentication. The risk is higher in environments where the plugin is exposed to public traffic and the database user has broad privileges.