The MailerLite – WooCommerce integration plugin suffers from an SQL Injection vulnerability (CVE-2025-67945) caused by improper neutralization of special elements in SQL commands. This allows remote attackers to execute arbitrary SQL queries on the affected system without authentication. The vulnerability affects all versions up to 3.1.2. The CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), indicating critical severity with high impact on confidentiality and partial impact on availability. No patch or vendor advisory is currently provided, and the product is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact). The integrity impact is not indicated, and availability impact is low. This could compromise the confidentiality of the affected system's data managed via the MailerLite – WooCommerce integration plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is available, users should monitor vendor communications closely. Until a fix is released, consider disabling or removing the vulnerable plugin to prevent exploitation. Avoid exposing the affected plugin to untrusted networks or users.