The Category Discount Woocommerce plugin contains an SQL injection flaw that can be triggered by users with administrative privileges on a WordPress site. By submitting crafted input, an attacker could execute arbitrary SQL statements against the site’s database. This could enable reading sensitive information, modifying product or discount data, or injecting malicious content that affects the integrity and availability of the shop. The weakness is a classic input validation failure classified as CWE-89.

The vulnerability affects the Vidish Category Discount Woocommerce plugin for WordPress on versions 5.18 and earlier. WordPress sites that have this plugin installed should verify the plugin version and update if it is 5.18 or lower.

The CVSS score of 7.6 classifies the flaw as high severity. No EPSS value is reported, and the vulnerability is not listed in CISA’s KEV catalog, indicating that there is no publicly known active exploitation at the time of this analysis. Based on the description, the likely attack vector is an authenticated administrator; an attacker would need to access the WordPress admin interface or obtain credentials that allow modification of plugin settings to exploit the flaw.