The vulnerability CVE-2025-31397 affects the smartcms Bus Ticket Booking with Seat Reservation for WooCommerce plugin (versions up to 1.7). It is caused by improper neutralization of special elements in SQL commands, enabling SQL Injection attacks. The CVSS 3.1 score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), indicating an attacker can exploit this remotely without privileges or user interaction, causing a significant confidentiality breach and some availability impact. No vendor advisory or patch links are currently available, and it is not a cloud service. The vulnerability is published and assigned by Patchstack, but no known exploits have been reported.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to perform SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact) and partial disruption of service (low availability impact). There is no indication of integrity impact. The vulnerability affects all users of the plugin up to version 1.7.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.