The vulnerability CVE-2025-9463 is a time-based SQL Injection in the PeachPay plugin for WooCommerce, affecting versions up to 1.117.5. The issue arises from improper neutralization of special elements in the 'order_by' parameter, which is used in SQL queries without adequate escaping or preparation. Authenticated attackers with at least Subscriber-level privileges can exploit this to append malicious SQL commands, potentially extracting sensitive data from the backend database. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. No known exploits in the wild have been reported, and no patch or remediation guidance is currently provided.

Successful exploitation allows an authenticated user with Subscriber-level access or higher to perform time-based SQL Injection attacks via the 'order_by' parameter. This can lead to unauthorized disclosure of sensitive information from the database. The vulnerability does not impact integrity or availability directly but compromises confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access where possible and monitor for unusual database query activity related to the 'order_by' parameter. Avoid granting unnecessary privileges to users and consider implementing web application firewall (WAF) rules to detect and block SQL Injection attempts targeting this parameter.