This vulnerability (CVE-2025-63029) affects WC Lovers WCFM Marketplace through version 3.7.1 and is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). It allows an attacker with high privileges to inject SQL commands due to insufficient input sanitization. The CVSS 3.1 base score is 7.6, with network attack vector, low attack complexity, required privileges, no user interaction, and a scope change. The impact includes high confidentiality loss and low availability impact. No patch or official remediation has been published by the vendor as of the current data.

Successful exploitation could allow an attacker with high privileges to execute unauthorized SQL commands, potentially leading to disclosure of sensitive information (confidentiality impact is high) and limited disruption of service (availability impact is low). Integrity impact is not indicated. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and monitor for suspicious database activity related to WCFM Marketplace. Avoid exposing the affected versions in untrusted environments.