The Advance Seat Reservation Management for WooCommerce plugin suffers from an SQL Injection vulnerability (CWE-89) due to insufficient escaping and lack of prepared statements for the 'profileId' parameter in its SQL queries. This flaw allows unauthenticated remote attackers to append malicious SQL code, potentially extracting sensitive information from the underlying database. The issue affects all versions up to 3.3. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low complexity, no privileges required, no user interaction, and high confidentiality impact without affecting integrity or availability.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information stored in the database. Since the attacker can inject arbitrary SQL commands via the vulnerable parameter without authentication, the confidentiality of the system's data is at risk. There is no indication that integrity or availability are impacted. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin component. Avoid exposing the affected parameter to untrusted inputs. Monitor vendor channels for updates and apply patches promptly once released.