CVE-2026-15205: fallo de gravedad alta en Paymob for WooCommerce
Paymob for WooCommerce < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup
Publicada el
63Vexday Risk Score
Prioriza la corrección. Ella explotación observada por VulnCheck y tiene prueba de concepto pública.
ssvc Actcvss 8.6epss 0.4%
de la publicación al arma
Publicada en NVD14 ago
VulnCheck14 ago
probabilidad de explotación
0.4%top 63% de las CVE
explotación observada
síVulnCheck
1 exploit(s) público(s)
The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows unauthenticated attackers to perform SQL injection and read arbitrary data from the database — including user credentials and other secrets — through both in-band (reflected) and time-based blind extraction.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Productos afectados
Unknown · Paymob for WooCommercePoCs públicas encontradas — 1
cve_referencewpscan.com/vulnerability/cbde48bb-5aa4-4f69-8101-095132239923/no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Paymob for WooCommerce
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-87979MEDIUMPaymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via WebhookEPSS 0.2%CVE-2026-87981MEDIUMPaymob for WooCommerce < 4.1.14 - Contributor+ Payment Gateway Configuration Deletion and Modification via Multiple AJAX ActionsEPSS 0.2%CVE-2026-87978MEDIUMPaymob for WooCommerce < 4.1.14 - Unauthenticated Payment Bypass via Unverified Subscription Transaction CallbackEPSS 0.1%