The vulnerability CVE-2025-31553 affects WPFactory's Advanced WooCommerce Product Sales Reporting plugin (up to version 4.1.1). It is caused by improper neutralization of special elements in SQL commands, leading to SQL Injection. This allows an unauthenticated attacker to execute arbitrary SQL queries remotely, potentially compromising confidentiality and availability. The CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), indicating critical severity with high impact on confidentiality and limited impact on availability. No vendor advisory or patch links are currently available, and no known exploits have been reported.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the affected system's database. This can lead to disclosure of sensitive information (high confidentiality impact) and partial denial of service (low availability impact). There is no indication of integrity impact. The vulnerability affects all installations of the plugin up to version 4.1.1.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin to mitigate risk. Monitor official WPFactory channels for updates and apply patches promptly once available.