This vulnerability (CVE-2025-30628) involves improper neutralization of special elements used in SQL commands (CWE-89) within the AA-Team Amazon Affiliates Addon for WPBakery Page Builder. It enables SQL Injection attacks that can be triggered remotely over the network with low attack complexity and requires only low privileges without user interaction. The vulnerability impacts confidentiality and availability, with a CVSS v3.1 score of 8.5, indicating high severity. Affected versions include all up to 1.2. No vendor advisory or patch links are provided, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker to execute unauthorized SQL commands, potentially leading to partial denial of service and disclosure of sensitive information. The vulnerability affects confidentiality and availability but not integrity. The attack requires low privileges and no user interaction, increasing the risk of exploitation. No known exploits have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected plugin and monitor for updates from AA-Team. Avoid exposing the plugin to untrusted users or networks. Do not rely on generic mitigations as the vendor has not provided specific guidance.