The vulnerability CVE-2025-26875 affects the Multiple Shipping And Billing Address For Woocommerce plugin (versions up to 1.3) by silverplugins217. It is caused by improper neutralization of special elements in SQL commands, leading to SQL Injection. This allows an unauthenticated attacker to execute arbitrary SQL queries remotely, potentially exposing sensitive data. The CVSS 3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and a significant confidentiality impact with limited availability impact. No vendor advisory or patch information is currently provided.

An attacker can exploit this vulnerability remotely without authentication to inject malicious SQL commands. This can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and minor disruption of service (low availability impact). Integrity impact is not indicated. The critical severity reflects the potential for serious data breaches if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or removing the affected plugin to prevent exploitation. Monitor for vendor updates or security advisories regarding this vulnerability.