The vulnerability identified as CVE-2025-48331 affects the WooCommerce Orders & Customers Exporter plugin by vanquish. It allows an attacker to retrieve embedded sensitive information through the insertion of such data into sent outputs. The flaw exists in versions up to 5.0 of the plugin. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates that the vulnerability is remotely exploitable over the network without authentication or user interaction, resulting in a high confidentiality impact but no integrity or availability impact. There is no vendor advisory or patch information currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of sensitive information embedded in the data sent by the WooCommerce Orders & Customers Exporter plugin. This compromises confidentiality but does not affect data integrity or system availability. The vulnerability is remotely exploitable without authentication or user interaction, increasing its risk profile. However, no active exploitation has been observed in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the plugin's export functionality to trusted users only and review exported data for sensitive information leakage.