The vulnerability CVE-2025-48299 in YayCommerce YayExtra (<=1.5.5) is an SQL Injection issue caused by improper neutralization of special elements in SQL commands. This allows an attacker with high privileges to execute crafted SQL commands that can compromise data confidentiality and cause partial availability impact. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and scope change with high confidentiality impact and low availability impact. No patch or official fix information is currently available.

Successful exploitation could allow an attacker with high privileges to execute unauthorized SQL commands, potentially leading to disclosure of sensitive information and limited denial of service. The integrity impact is reported as none, so data modification or destruction is not indicated. The vulnerability affects confidentiality and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin to trusted users with high privileges and monitor for unusual database activity. Avoid exposing the vulnerable component to untrusted networks or users. Follow vendor updates closely for official patches or mitigations.