CVE-2025-22533 describes an SQL Injection vulnerability in the bulktheme WOOEXIM plugin (versions up to 5.0.0). The vulnerability arises from improper neutralization of special elements in SQL commands, allowing an attacker with high privileges to execute unauthorized SQL queries. The CVSS 3.1 score is 7.6 (High), with network attack vector, low attack complexity, no user interaction, and scope changed. The impact is high confidentiality loss, no integrity impact, and low availability impact. No patch or vendor advisory is currently available, and no known exploits have been reported.

An attacker with high privileges can exploit this SQL Injection vulnerability to access or exfiltrate sensitive data, resulting in a high confidentiality impact. Integrity is not impacted, and availability impact is low. The vulnerability requires network access and no user interaction but does require elevated privileges, limiting the attack surface somewhat. No known exploits are currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high-privilege access to the WOOEXIM plugin and monitor for unusual database activity. Apply vendor patches promptly once available.