CVE-2024-37564 HIGH

CVE-2024-37564: WordPress PayPlus Payment Gateway plugin <= 7.0.7 - SQL Injection vulnerability

Vendor Payplus Ltd

Product PayPlus Payment Gateway

Weakness CWE-89 · SQLi

Published July 12, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

8.5/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

What the vulnerability does

01Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PayPlus LTD PayPlus Payment Gateway.This issue affects PayPlus Payment Gateway: from n/a through 7.0.7.

Explanation of Vulnerability in Simple Terms

02Summary

PayPlus Payment Gateway versions up to 7.0.7 contain a SQL injection vulnerability in a component requiring low-level authentication. An attacker with a valid user account can craft malicious input to extract sensitive data from the database, including customer payment information and site credentials. The vulnerability also allows limited disruption of service availability.

What an attacker can do

03Attacker Capabilities

Extract sensitive data from the site database, including customer records and credentials.

Potential impact on your site

04Site Impact

Customer payment data and site credentials may be exposed; service availability may be degraded.

Conditions required to exploit

05Prerequisites

Attacker must have a valid user account with low-level privileges on the site.

Key dates

06Disclosure timeline

July 12, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-37564 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html AskarLabs — CWE-89 write-up SQL Injection

Related vulnerabilities

Identifiers

CVE CVE-2024-37564

CWE CWE-89

CVSS 8.5 / HIGH

Affected versions