The vulnerability CVE-2025-22505 exists in Crispweb's NC Wishlist for Woocommerce plugin (versions <= 1.0.1) and is caused by improper neutralization of special elements used in SQL commands, resulting in an SQL Injection flaw. This allows an attacker with low privileges and no user interaction to execute crafted SQL commands that can compromise data confidentiality. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, and partial privileges required. The impact includes high confidentiality loss and low availability impact, with no integrity impact reported. No vendor patch or official fix information is available at this time.

An attacker with low privileges can exploit this SQL Injection vulnerability to access or disclose sensitive database information, potentially leading to data breaches. The vulnerability does not affect data integrity but can cause limited availability issues. The high confidentiality impact indicates that sensitive data could be exposed. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin and monitor for unusual database activity. Avoid using affected versions (<= 1.0.1) in production environments if possible.