The vulnerability identified as CVE-2025-31056 affects the Techspawn WhatsCart plugin for WooCommerce, which provides WhatsApp-based abandoned cart recovery, order notifications, chat box, and OTP features. The issue is an SQL Injection caused by improper neutralization of special elements in SQL commands, allowing remote attackers to execute arbitrary SQL code. The affected versions include all versions up to 1.1.0. The CVSS 3.1 score of 9.3 reflects critical severity with network attack vector, no required privileges or user interaction, and a scope change with high confidentiality impact. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database of the affected plugin. This could lead to unauthorized disclosure of sensitive information (high confidentiality impact). The vulnerability does not impact data integrity but may cause limited availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin version to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.