PayPlus Payment Gateway < 6.6.9 - Unauthenticated SQLi
78Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 7.6epss 4.1%
from disclosure to weapon2 days
Published on NVDJul 19
1st PoC+2d
VulnCheck+187d
exploitation probability
4.1%top 10% of all CVEs
observed exploitation
yesVulnCheck
1 public exploit(s)
The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated users, leading to an SQL injection vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Affected products
Unknown · PayPlus Payment Gatewaypublic PoCs found — 1
vulncheckvulncheck.com/xdb/f04b68ceacf3unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.