The Suggestion Engine for WooCommerce plugin is vulnerable to SQL injection, which could allow an authenticated contributor to extract sensitive database information.

This vulnerability is a SQL injection (CWE-89) flaw that allows an authenticated user with contributor-level privileges to manipulate database queries. The issue exists due to improper neutralization of special elements used in SQL commands within the plugin.

Successful exploitation of this vulnerability can lead to the unauthorized disclosure of sensitive data stored within the WordPress database. Given the high CVSS score of 8.5, this flaw poses a significant risk to data confidentiality and could lead to a compromise of customer or administrative information.

Immediate Action: Update the Suggestion Engine for WooCommerce plugin to version 2.0.12 or the latest available version provided by VillaTheme.

Proactive Monitoring: Review database query logs for anomalous or unauthorized SQL patterns that originate from accounts with contributor-level permissions.

Compensating Controls: Deploy a Web Application Firewall with rules configured to detect and block common SQL injection payloads.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing the Suggestion Engine for WooCommerce plugin should prioritize updating to version 2.0.12 immediately to eliminate this injection vector. Failure to patch may allow attackers to bypass intended access controls and compromise the integrity of the underlying database.