An authenticated SQL injection vulnerability in the YITH WooCommerce Product Add-Ons plugin could allow an administrator to compromise database integrity.

The plugin fails to properly neutralize special elements in SQL commands (CWE-89), allowing an attacker with administrative privileges to execute blind SQL injection attacks.

Exploitation of this vulnerability could allow an attacker to extract sensitive information from the WordPress database or modify data, leading to severe confidentiality and integrity impacts. Although the CVSS score is 7.6, the requirement for administrative privileges mitigates the risk for unauthenticated users, though it remains a critical concern for compromised administrative accounts.

Immediate Action: Update the YITH WooCommerce Product Add-Ons plugin to version 4.29.1 or later immediately.

Proactive Monitoring: Review database query logs for suspicious activity, specifically focusing on unexpected or malformed SQL statements originating from administrative sessions.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a layer of protection while updates are being staged.

Public Exploit Available: Unknown

Administrators must update the plugin to the latest version to close this injection vector. Given the sensitive nature of database interactions in e-commerce environments, ensuring the plugin is patched is essential to protecting customer data and maintaining site integrity against potential administrative account compromise.