The vulnerability CVE-2025-23967 affects the wpopal GG Bought Together for WooCommerce plugin (versions <= 1.0.2). It is caused by improper neutralization of special elements in SQL commands, enabling SQL Injection attacks. This allows unauthenticated remote attackers to execute arbitrary SQL queries, potentially compromising database confidentiality and causing limited denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and scope change with high confidentiality impact and low availability impact. No patch or official remediation information is currently available.

An attacker can exploit this vulnerability remotely without authentication to execute arbitrary SQL commands on the affected system's database. This can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the affected plugin or restricting access to it to trusted users only. Monitor official vendor channels for updates and apply patches promptly once available.