CVE-2025-10144 is a time-based SQL Injection vulnerability in the Perfect Brands for WooCommerce plugin for WordPress, affecting all versions up to 3.6.2. The issue arises from improper neutralization of special elements in the 'brands' attribute of the 'products' shortcode, allowing authenticated users with Contributor or higher privileges to append malicious SQL queries. This occurs due to insufficient escaping of user input and lack of prepared statements in the SQL query construction, enabling potential unauthorized data extraction from the database.

An attacker with Contributor-level or higher access can exploit this vulnerability to perform time-based SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure, as indicated by the CVSS vector (Confidentiality: High, Integrity: None, Availability: None). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access where possible and monitor for suspicious activity related to the 'products' shortcode usage. Avoid using the vulnerable versions of the plugin if feasible.