The software defect is an instance of Improper Neutralization of Special Elements used in an SQL Command, commonly referred to as SQL Injection (CWE‑89). The WordPress plugin APIExperts Square for WooCommerce contains blind SQL injection points that allow a malicious user to inject arbitrary SQL commands into database queries. The CVE text does not give explicit details on the consequences, but a blind injection typically permits attackers to exfiltrate, modify, or delete data. It is inferred from the description that such impacts are possible, though the CVE does not confirm them directly.

The vulnerability applies to the APIExperts Square for WooCommerce WordPress plugin (woosquare) in all releases up through version 4.7.1. WordPress sites that have installed this plugin and are running any of those releases are within the risk zone.

According to the CVSS score of 8.5, this is a high severity issue. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers are likely to exploit the exposed plugin interfaces, which may be reachable to unauthenticated or authenticated users depending on site configuration. Successful exploitation could result in unauthorized database manipulation or data disclosure, consistent with the CWE‑89 threat model.