cve-2026-15205
HIGH CVSS 8.6 vulncheck_kev
Description
The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows unauthenticated attackers to perform SQL injection and read arbitrary data from the database — including user credentials and other secrets — through both in-band (reflected) and time-based blind extraction.
Timeline
- Published
- 2026-08-14 00:00 UTC
- Last Modified
- 2026-08-14
CVSS Details
CVSS details not available.
Affected Products
No product information available.
References
No references available.
Linked Vulnerabilities
No linked vulnerabilities found.
{
"cvss": 8.6,
"datePublished": "2026-08-14T00:00:00Z",
"dateUpdated": "2026-08-14T00:00:00Z",
"description": "The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows unauthenticated attackers to perform SQL injection and read arbitrary data from the database — including user credentials and other secrets — through both in-band (reflected) and time-based blind extraction.",
"dueDate": "",
"id": "CVE-2026-15205",
"kev_catalogs": [
"vulncheck"
],
"knownRansomwareCampaignUse": "Unknown",
"product": "Paymob for WooCommerce",
"requiredAction": "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.",
"severity": "HIGH",
"source": "vulncheck_kev",
"title": " Improper Neutralization of Special Elements used in an SQL Command",
"vendor": "Paymob"
}