CVE-2025-47537: 
WordPress vulnerability analysis and mitigation

An SQL Injection vulnerability was discovered in PDF Invoices for WooCommerce + Drag and Drop Template Builder plugin affecting versions through 5.3.8. The vulnerability was discovered by Ngo Bui Truong Vu and disclosed on May 7, 2025 (Patchstack).

The vulnerability is classified as an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') with a CVSS v3.1 base score of 7.6 (High). The attack vector is Network-based (AV:N) with Low attack complexity (AC:L), requires High privileges (PR:H), and No user interaction (UI:N). The scope is Changed (S:C) with High impact on Confidentiality (C:H), No impact on Integrity (I:N), and Low impact on Availability (A:L) (NVD, Wiz).

This vulnerability could allow a malicious actor with administrator privileges to directly interact with the database, potentially leading to unauthorized access to sensitive information stored in the WordPress database (Patchstack).

Users are advised to update to version 5.4.0 or later which contains a fix for this vulnerability. Patchstack users can enable auto-update functionality for vulnerable plugins as an additional security measure (Patchstack).