The vulnerability identified as CVE-2025-23967 affects the wpopal GG Bought Together for WooCommerce plugin (versions up to 1.0.2). It is an SQL Injection flaw caused by improper neutralization of special elements in SQL commands. This allows remote attackers to execute arbitrary SQL queries without authentication, potentially compromising sensitive data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation of this vulnerability could allow an attacker to access or disclose sensitive database information, impacting confidentiality severely. The integrity of the data is not affected according to the CVSS vector, but availability impact is low. No known exploits are reported in the wild, so active exploitation is not confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin version to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.