8.6
Élevée
CVE-2026-15205 The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier…
Description
The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows unauthenticated attackers to perform SQL injection and read arbitrary data from the database — including user credentials and other secrets — through both in-band (reflected) and time-based blind extraction.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Paymob for WooCommerce 4.1 | premières → < 4.1.9 | 4.1.9 |
Autres CVE de Paymob for WooCommerce
Les 4 CVE de Paymob for WooCommerce →
CVE-2026-87978
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its…
5.3
Moyenne
CVE-2026-87981
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX…
4.7
Moyenne
CVE-2026-87979
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch…
5.3
Moyenne