The vulnerability CVE-2025-22713 affects the WooCommerce Orders & Customers Exporter plugin by vanquish. It is an SQL Injection issue caused by improper neutralization of special elements in SQL commands. This allows an attacker with network access and low privileges to exploit the vulnerability without user interaction, potentially leading to a partial denial of service and unauthorized access to confidential data. The affected versions include all versions up to 5.4. The CVSS v3.1 base score is 8.5, indicating high severity with network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact.

An attacker could exploit this SQL Injection vulnerability to access sensitive information from the database, leading to a high confidentiality impact. The vulnerability also allows for a partial denial of service, impacting availability. The integrity of data is not affected according to the CVSS vector. The attack requires low privileges and no user interaction, increasing the risk of exploitation. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting network access to the affected plugin's functionalities and review user privileges to minimize exposure.