A critical SQL injection vulnerability in the WooCommerce Point Of Sale (POS) plugin enables authenticated attackers to potentially exfiltrate sensitive database information.

The plugin fails to properly sanitize user-supplied input before incorporating it into database queries, which facilitates SQL injection. Per the CVSS vector (PR:L), this flaw requires the attacker to have at least low-level authenticated access to the application.

Successful exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive business or customer data stored within the WordPress database. Given the CVSS score of 8.5, this high-severity flaw poses a significant risk to data confidentiality and integrity, potentially leading to regulatory non-compliance and loss of customer trust.

Immediate Action: Since no specific patch version is currently confirmed, users should immediately disable or remove the WooCommerce Point Of Sale (POS) plugin until a vendor-supplied update is available.

Proactive Monitoring: Security teams should review database query logs for unusual patterns or syntax that deviate from standard application behavior, particularly for requests originating from authenticated user accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns to provide a virtual patch while awaiting a formal vendor update.

Public Exploit Available: No (exploit_available: unknown).

The presence of a high-severity SQL injection flaw requires immediate attention to protect the integrity of the backend database. Administrators must prioritize the containment of this vulnerability by deactivating the plugin immediately and monitoring for any signs of unauthorized database access or anomalous activity.