CVE-2026-103307
8.6HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-89
Impact
Unauthenticated remote attackers can execute arbitrary SQL injection attacks and mark orders as paid. They only need network access to reach the WordPress site's payment webhook.
Root cause
The plugin fails to sanitize user input in SQL queries and defaults to an empty signing secret when validating payment webhooks.
Affected systems
Walletdoc Payment Gateway for WooCommerce plugin before 1.8.5
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Fix & remediation
Upgrade the Walletdoc Payment Gateway for WooCommerce plugin to version 1.8.5 or later. If patching immediately is not possible, deactivate the plugin or set a non-empty webhook signing secret in the plugin settings.
$ wp plugin update walletdoc-woocommerce-payment-gateway --version=1.8.5AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL injection attacks and to mark arbitrary orders as paid.