CVE-2025-13495 describes an SQL Injection vulnerability in the FluentCart WordPress plugin affecting all versions up to 1.3.1. The issue arises from insufficient escaping and lack of proper preparation of the 'groupKey' parameter in SQL queries. Authenticated attackers with Administrator privileges can exploit this to append malicious SQL commands, potentially extracting sensitive data from the database. The vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 4.9 (medium severity). No known exploits in the wild or vendor patches are currently documented.

An attacker with Administrator-level access can exploit this vulnerability to perform SQL Injection attacks, enabling unauthorized reading of sensitive information from the database. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure as per the CVSS vector (C:H/I:N/A:N). There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to the 'groupKey' parameter. Avoid using vulnerable versions of FluentCart where possible.