CVE-2025-47537 describes an SQL Injection vulnerability in the PDF Invoice Builder for WooCommerce plugin (versions up to 5.3.8) from add-ons.org. The vulnerability results from improper neutralization of special elements in SQL commands, which could allow an attacker with high privileges to execute injected SQL queries. The CVSS 3.1 score of 7.6 reflects a network attack vector with low complexity but requiring high privileges and no user interaction. The vulnerability impacts confidentiality and availability but not integrity. No patch or official fix information is provided in the available data.

An attacker with high privileges on the affected system could exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). There is no indication of integrity impact. No known exploits are reported at this time.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and ensure only trusted users have high privileges. Monitor vendor channels for updates and apply patches promptly once released.