The WowStore plugin for WooCommerce contains an unauthenticated SQL injection vulnerability that allows remote attackers to extract sensitive database information.

This flaw is a SQL injection vulnerability (CWE-89) located in the search parameter, caused by insufficient escaping and lack of prepared statements. It allows unauthenticated attackers to append malicious SQL commands to existing queries.

The ability for an unauthenticated attacker to manipulate database queries poses a significant risk of data exfiltration, including sensitive customer or store information. With a CVSS score of 7.5, this vulnerability represents a high-severity threat that could lead to a full breach of the underlying WordPress database and potential compromise of store integrity.

Immediate Action: Since a specific patched version is currently unknown, administrators should immediately deactivate or remove the WowStore plugin until a secure update is provided by the vendor.

Proactive Monitoring: Monitor database access logs for anomalous, high-frequency query patterns or unexpected SQL syntax errors originating from external requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns to help mitigate potential exploitation attempts while the plugin remains inactive.

Public Exploit Available: Unknown

Given the high CVSS score and the lack of authentication required to execute the exploit, this vulnerability presents an immediate danger to store data. Organizations utilizing this plugin must prioritize its removal or deactivation until the vendor releases a definitive patch. Continuous monitoring of security advisories from the vendor is essential to ensure a timely return to service once remediation is confirmed.