CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 5.9.0.
Explanation of Vulnerability in Simple Terms
WooPayments versions up to 5.9.0 contain a SQL injection vulnerability accessible to high-privilege users. An attacker with admin or equivalent access can craft malicious input to execute arbitrary SQL queries, potentially reading sensitive payment and customer data. The vulnerability affects the plugin's database queries and requires administrative credentials to exploit.
What an attacker can do
Read sensitive payment and customer data from the site's database via SQL injection.
Potential impact on your site
A malicious admin or compromised admin account can extract payment records, customer information, and other sensitive database contents.
Conditions required to exploit
Attacker must have high-level admin or equivalent privileges on the WordPress site.
Key dates
External resources
Related vulnerabilities
