The Persian Woocommerce SMS plugin by PersianScript contains an SQL Injection vulnerability (CVE-2025-49315) due to improper neutralization of special elements in SQL commands. This vulnerability affects all versions up to 7.0.10. The CVSS 3.1 score is 7.6 (high), with an attack vector of network, low attack complexity, requiring high privileges, no user interaction, and a scope change. The impact includes high confidentiality loss and low availability impact, with no integrity impact. No patch or vendor advisory is currently provided, and no known exploits have been reported.

An attacker with high privileges can exploit this SQL Injection vulnerability to access sensitive data from the database, resulting in a high confidentiality impact. The vulnerability does not affect data integrity but may cause a low level of availability disruption. Since the attack requires high privileges, exploitation is limited to users with elevated access. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and monitor for suspicious database activity related to the Persian Woocommerce SMS plugin. Avoid exposing the affected plugin to untrusted users. Do not assume the vulnerability is mitigated without vendor confirmation.