The sonalsinha21 Recover abandoned cart for WooCommerce plugin versions up to 2.5 contain an SQL Injection vulnerability caused by improper neutralization of special elements in SQL commands. This allows an unauthenticated attacker to execute arbitrary SQL queries remotely, potentially compromising the confidentiality of the database. The vulnerability is rated critical with a CVSS 3.1 score of 9.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and a significant confidentiality impact. No patch or official remediation guidance is currently provided.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the affected system's database, potentially leading to unauthorized disclosure of sensitive information. The vulnerability does not directly impact integrity or availability but poses a significant confidentiality risk. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once released.