The vulnerability CVE-2025-58686 in quadlayers Perfect Brands for WooCommerce plugin allows SQL Injection due to improper neutralization of special elements in SQL commands. This affects all versions up to 3.6.2. The CVSS 3.1 score is 8.5, indicating high severity with network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change. The impact includes high confidentiality compromise and low availability impact. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation could allow an attacker with low privileges to execute SQL Injection attacks, potentially leading to unauthorized access to sensitive data (high confidentiality impact) and partial denial of service (low availability impact). Integrity impact is not indicated. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. In the meantime, restrict access to the plugin's administrative interfaces to trusted users only and consider disabling the plugin if feasible until a fix is available.