Description

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows unauthenticated attackers to perform SQL injection and read arbitrary data from the database — including user credentials and other secrets — through both in-band (reflected) and time-based blind extraction.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-14T06:16:59.727Z",
  "pubdate": "2026-08-14T06:16:59.727Z",
  "executiveSummary": "The Paymob for WooCommerce WordPress plugin before 4.1.9 suffers from an unauthenticated SQL injection vulnerability residing within its public payment callback mechanism.\nThe core vulnerability allows remote, unauthenticated attackers to manipulate a client-supplied identifier that is directly concatenated into a database query without proper sanitization.\nCrucially, the vulnerable SQL query execution occurs prior to the validation of the payment provider's cryptographic HMAC signature, bypassing intended security gates.\nThe impact of this flaw is critical, enabling unauthorized threat actors to extract arbitrary data from the underlying database through both in-band reflected responses and time-based blind extraction techniques.\nCompromised information may include sensitive records such as user credentials, hashed passwords, and other application secrets.\nNo privileges or user interaction are required to exploit this vulnerability, as the attack surface is exposed via the public-facing HTTP callback endpoint utilized during payment processing workflows.",
  "technicalDetails": "The vulnerability stems from insufficient input sanitization and improper validation sequencing within the Paymob for WooCommerce WordPress plugin prior to version 4.1.9.\nSpecifically, the vulnerable component is the public, unauthenticated payment callback endpoint exposed by the plugin to handle transaction responses from the payment gateway.\nThe root cause of the flaw is the direct inclusion of a client-supplied identifier into an SQL query string without employing parameterized queries, prepared statements, or adequate data sanitization routines.\nFurthermore, architectural logic flaws compound the risk: the database query is executed prematurely before the application verifies the cryptographic HMAC signature sent by the payment provider to ensure the integrity and authenticity of the request.\nBecause signature verification is bypassed or deferred until after the malicious query executes, an unauthenticated attacker can interact directly with the callback URL over the network without possessing valid payment tokens or secrets.\nThe attack flow proceeds as follows: First, the attacker sends a crafted HTTP request to the public payment callback endpoint containing a malicious payload injected into the vulnerable client-supplied identifier parameter.\nSecond, the application processes the input and executes the unsanitized SQL query against the database backend.\nThird, the attacker leverages both in-band (reflected) SQL injection techniques to extract data directly within HTTP responses, and time-based blind extraction methodologies to infer data character-by-character based on database response latency.\nPost-exploitation impact includes full database read access, allowing the retrieval of sensitive assets stored in the WordPress database, including administrative credentials, user session tokens, and plugin configuration secrets."
}