The vulnerability identified as CVE-2025-58951 affects the smartcms Advance Seat Reservation Management for WooCommerce plugin (version ≤ 3.1). It is caused by improper neutralization of special elements used in SQL commands, leading to an SQL Injection vulnerability. This allows remote attackers to execute arbitrary SQL commands without authentication, potentially compromising database confidentiality and causing limited availability impact. The CVSS v3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), reflecting a critical severity level. No patch or official remediation guidance is currently available from the vendor.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive database information due to SQL Injection. The vulnerability does not directly affect integrity but impacts confidentiality and causes limited availability issues. Since no privileges or user interaction are required, the attack vector is network-based and can be exploited remotely. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.