SQL injection in Walletdoc Payment Gateway for WooCommerce
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-89.
Summary
The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not sanitize user input before using it in a SQL statement (CWE-89). An unauthenticated remote attacker can inject SQL commands, and the payment webhook uses a signing secret that is empty by default, which lets the attacker mark arbitrary orders as paid. A public exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL injection attacks and to mark arbitrary orders as paid.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Walletdoc Payment Gateway for WooCommerce | before 1.8.5 | 1.8.5 | Patch available | CNA |
- Walletdoc Payment Gateway for WooCommerce VendorUnknown Affected before 1.8.5 Fixed in 1.8.5 Patch available CNA
Remediation
Update Walletdoc Payment Gateway for WooCommerce to version 1.8.5, the first fixed version. The sources do not list a vendor advisory for this fix.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA Walletdoc Payment Gateway for WooCommerce (Unknown) Fixed in 1.8.5
Timeline
- 2026-10-14 Threatist record created from CVE-2026-103307
- 2026-10-14 Alias added: GHSA-wxpq-v4f2-m2jf
- 2026-10-14 CVSS score added · CISA ADP
- 2026-10-14 Weakness changed · CISA ADP
- 2026-10-14 CISA SSVC decision points changed
- 2026-10-14 Priority changed: LOW → MEDIUM
References
Sources
- CVE-2026-103307 · CVE Program
- CVE-2026-103307 · NVD
- FIRST EPSS
- GHSA-wxpq-v4f2-m2jf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences