CVE-2025-47643 describes an SQL Injection vulnerability (CWE-89) in the ELEXtensions ELEX Product Feed for WooCommerce plugin, affecting versions through 3.1.2. The issue is due to improper neutralization of special elements in SQL commands, which can be exploited by an attacker with high privileges to execute unauthorized SQL queries. The vulnerability has a CVSS score of 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), indicating network attack vector, low attack complexity, required high privileges, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No patch or official fix information is currently available.

An attacker with high privileges on the system could exploit this vulnerability to execute unauthorized SQL commands, potentially leading to disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). There is no reported impact on data integrity. No known exploits have been observed in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should restrict access to high-privilege accounts and monitor for unusual activity related to the plugin. Avoid exposing the plugin to untrusted users with elevated privileges. Apply official updates from ELEXtensions promptly once they are released.