Input validation vulnerability in Product Vendors 2.1.78

The WooCommerce Product Vendors plugin is vulnerable to a type of attack called SQL Injection in versions up to and including 2.1.78. This type of attack allows attackers with shop manager-level access (or higher) to add extra SQL queries into existing queries which can be used to gain access to sensitive information from the database. The vulnerability is caused by a lack of security when it comes to the user-supplied parameter, as well as insufficient preparation of the existing SQL query.