This vulnerability (CVE-2026-65532) in Persian Woocommerce SMS (<=7.2.2) is caused by improper neutralization of special elements used in SQL commands (CWE-89), enabling SQL Injection attacks by a shop manager. The CVSS 3.1 score is 7.6 (high), reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and a scope change with high confidentiality impact and low availability impact. No known exploits in the wild or vendor patches have been reported as of the publication date.

Successful exploitation allows a shop manager to execute arbitrary SQL commands, potentially leading to full confidentiality compromise of the database and partial denial of service. Integrity impact is not indicated. The vulnerability requires high privileges, limiting the attacker to users with shop manager access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict shop manager privileges to trusted users only and monitor for suspicious activity related to SQL queries in the application.