CVE-2025-63029

CVE-2025-63029 is a SQL injection vulnerability in WC Lovers WCFM Marketplace affecting versions 3.7.1 and earlier, which allows attackers to inject malicious SQL commands through improper neutralization of special elements. The vulnerability exists in the wc-multivendor-marketplace component and could potentially compromise database integrity and confidential information. The vulnerability has a CVSS score of 7.6 (HIGH) with a network-based attack vector requiring high privileges but no user interaction. The attack complexity is low, meaning exploitation is straightforward. Impact assessment indicates high confidentiality risk and low availability impact, with the ability to affect multiple systems through account compromise (CVSS scope changed). Exploitation status shows no evidence of active exploitation in the wild, with no known exploit code in the KEV catalog or widespread community attention. The EPSS score of 0.00036 indicates very low probability of exploitation relative to other CVEs, and the vulnerability remains inactive on security hotlists. Organizations using affected versions should prioritize patching, though the immediate threat level appears limited based on current threat intelligence.