Description

The GoPay for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'log_table_filter' parameter in all versions up to, and including, 1.0.36 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-09-19T08:16:54.487Z",
  "pubdate": "2026-09-19T08:16:54.487Z",
  "executiveSummary": "The GoPay for WooCommerce plugin for WordPress contains a critical SQL Injection vulnerability affecting all versions up to and including 1.0.36.\nThe vulnerability arises from improper handling of user-supplied data within the 'log_table_filter' parameter, failing to sanitize input before it is incorporated into database queries.\nThis flaw enables authenticated attackers with shop manager-level permissions or higher to manipulate backend SQL commands, posing a severe risk to data confidentiality and database integrity.\nBy injecting malicious SQL statements, an attacker can bypass standard application logic to execute unauthorized queries.\nThe primary risk implication is the potential for unauthorized extraction of sensitive information from the underlying database, including customer data, order details, or system credentials.\nExploitation requires the attacker to possess an active session with at least shop manager privileges, limiting the scope of external, unauthenticated threats while significantly impacting the security posture of the WordPress installation internally.",
  "technicalDetails": "The vulnerability is classified as a generic SQL Injection (SQLi) stemming from the insufficient escaping of the 'log_table_filter' parameter used within the GoPay for WooCommerce plugin.\nThe root cause is a failure to utilize parameterized queries or adequate input sanitization functions provided by the WordPress database abstraction layer ($wpdb) when processing the 'log_table_filter' parameter.\nBecause the input is passed directly into a dynamic SQL query string, an attacker can manipulate the query structure by injecting SQL syntax characters such as single quotes, semicolons, or comment indicators.\nThe attack flow begins with an authenticated user, holding shop manager-level access, intercepting the request containing the 'log_table_filter' parameter. The attacker can then inject a crafted payload designed to alter the intended SQL execution flow.\nFor example, an attacker could terminate the original query and append a 'UNION SELECT' statement or other data-extraction commands. This allows the attacker to retrieve data from arbitrary tables within the database that the WordPress database user has permissions to access.\nAs the application fails to utilize proper preparation methods (e.g., $wpdb->prepare()), the database engine interprets the malicious input as executable code rather than literal data. This lack of separation between code and data is the fundamental flaw allowing the injection.\nThe vulnerable component is the processing logic responsible for filtering logs where 'log_table_filter' is handled. Since this occurs on the server-side, it is not mitigated by client-side browser protections.\nSuccessful exploitation grants the attacker read access to the database content. Depending on the database user's privileges, the impact could extend beyond data theft to include data modification or deletion, or even leveraging the SQLi to perform administrative tasks within the database management system.\nThis vulnerability persists across all plugin versions up to and including 1.0.36. The requirement for elevated privileges (shop manager) mitigates the risk from public-facing automated bots but remains a significant threat from malicious or compromised administrative accounts."
}