The questiongets changed.
Your site keeps its customers, orders and passwords in a database, and asks it questions all day. This flaw lets a stranger change the question.
What it is
When someone searches your shop or signs in, the software turns what they typed into a question for the database, such as "show the orders for this customer". If it pastes their words straight into the question, carefully chosen words can change what is being asked.
The database cannot tell that part of its question came from a stranger. It simply answers.
What could happen to your site
Whatever the database holds can be read: customer names and addresses, orders, email addresses and the scrambled password records. Often it can be changed too, which means altered prices, deleted records, or a new administrator account the stranger can sign in with.
A leak of customer details is something you may have to report to the Information Commissioner's Office within 72 hours, so this kind of flaw matters even on a small site.
How likely it is
Less common than it was, because modern software is built to keep visitors' words apart from the question. It still turns up in plugins, often in the parts only signed in users can reach. One that needs no login is usually graded Dangerous, and attackers look for them automatically.
How it gets fixed
The software is changed to hand the database the visitor's words separately from the question, so they can only ever be treated as words. For you, the fix is the update. A firewall service can block common attempts in the meantime, but the update is what closes it.
What to ask your developer
Send whoever looks after your site this:
Ask your developer“The Mendbird report says some of our software has a known database injection flaw. Can you update it to the fixed version, and check nothing in the database was changed?”