Premmerce Wishlist for WooCommerce, versions 1.1.11 and earlier, suffers from an unauthenticated SQL injection flaw (CWE‑89). The vulnerability allows a remote user to send crafted input that is incorporated directly into SQL statements, enabling the execution of arbitrary SQL commands against the WordPress database. This can lead to unintended data reading, modification, or deletion, thereby compromising the integrity and confidentiality of the site data.

The flaw exists in the Premmerce Wishlist for WooCommerce plugin for WordPress. Any WordPress site that has installed this plugin and is running a version equal to or older than 1.1.11 is vulnerable. Sites that have not updated to 1.1.12 or newer remain affected.

The CVSS score of 9.3 classifies the vulnerability as critical. The attack vector is remote, requires no authentication, and can be exercised by sending specially crafted HTTP requests to the plugin’s endpoints. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the combination of a high severity rating and the lack of authentication requirements make exploitation highly plausible in practice.