A critical SQL injection vulnerability in the WooCommerce Ultimate Gift Card plugin allows unauthenticated attackers to compromise database integrity, posing a severe risk to site security.

This is an SQL Injection (CWE-89) vulnerability occurring due to improper neutralization of special elements in SQL commands. The vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector AV:N/PR:N.

Successful exploitation allows an attacker to manipulate database queries, potentially leading to unauthorized data exposure or modification. Given the CVSS score of 9.3, this flaw presents a critical risk to the confidentiality and integrity of customer and store data, which may result in significant reputational damage and regulatory non-compliance.

Immediate Action: Update the WooCommerce Ultimate Gift Card plugin to version 2.9.7 or later immediately.

Proactive Monitoring: Monitor database query logs for anomalous patterns or unexpected syntax that may indicate automated injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns targeting WordPress plugins.

Public Exploit Available: Unknown (No weaponized exploit or curated public PoC confirmed in available data).

The severity of this vulnerability necessitates immediate action. Administrators must prioritize updating the WooCommerce Ultimate Gift Card plugin to version 2.9.7 to eliminate the injection vector. Failure to patch leaves the underlying database exposed to unauthorized access.