The Active Products Tables for WooCommerce plugin fails to neutralize special characters used in database queries, allowing an attacker to inject arbitrary SQL commands. The flaw permits a blind SQL injection attack that can reveal confidential data or modify the site’s content and transaction records. The weakness is identified as CWE‑89.

Organizations running the RealMag777 Active Products Tables for WooCommerce plugin (profit‑products‑tables‑for‑woocommerce) on any version up to and including 1.0.8 are affected. The issue does not apply to versions beyond 1.0.8, though the checker shows no information for newer releases.

The CVSS score of 9.3 signifies critical severity, indicating wide potential impact on confidentiality, integrity, and availability. EPSS data are not available, and the vulnerability is not listed in the CISA KEV catalog, so the current public evidence of exploitation is unclear. Attackers can exploit the flaw through the web interface exposed by the plugin, sending crafted inputs to the database. While the injection is blind, repeated requests can infer data structures or values, and once confirmed, the attacker can pivot to further attacks within the WordPress environment.