Payamito SMS WooCommerce CVE-2025-13077
HIGHSeverity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network injection (AV:N/PR:N/UI:N), low complexity as blind SQLi is reliably automatable (AC:L), and confidentiality-only data disclosure (C:H, I:N, A:N).
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
3DescriptionCVE.org
The افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'columns' parameter in all versions up to, and including, 1.3.5. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
Time-based blind SQL injection in the Payamito SMS WooCommerce plugin for WordPress (versions up to and including 1.3.5) allows unauthenticated attackers to extract sensitive database information via the 'columns' parameter. The vulnerability requires the plugin to be installed and active alongside WooCommerce, and exploitation is noisy due to the request-heavy nature of time-based blind extraction. No public exploit code was identified at time of analysis, and the EPSS score is 0.45% (37th percentile), indicating low likelihood of exploitation; it is not listed in CISA KEV.
Technical ContextAI
The vulnerability is a time-based blind SQL injection (CWE-89) in the Payamito SMS WooCommerce plugin, caused by insufficient escaping of the user-supplied 'columns' parameter and lack of proper SQL query preparation. The vulnerable code resides in the plugin's admin class (includes/core/payamito-core/admin/class-payamito-admin.php#L64) and database class (includes/core/payamito-core/includes/class-db.php#L64). An attacker can inject SQL that triggers conditional time delays (e.g., using SLEEP) to infer data from the database. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N confirms a network-reachable, unauthenticated attack with high confidentiality impact but no integrity or availability impact. No CPE identifiers were provided in the input data.
Affected ProductsAI
The affected product is the Payamito SMS WooCommerce plugin (افزونه پیامک ووکامرس فوق حرفه ای (جدید)) for WordPress, all versions up to and including 1.3.5. The plugin requires WooCommerce to be installed and active. No CPE identifiers were provided. For details, see the vendor advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/75de6387-fac7-403d-9e6c-89570658d978?source=cve and the source code references at https://plugins.trac.wordpress.org/browser/payamito-sms-woocommerce/tags/1.3.5/includes/core/payamito-core/admin/class-payamito-admin.php#L64 and https://plugins.trac.wordpress.org/browser/payamito-sms-woocommerce/tags/1.3.5/includes/core/payamito-core/includes/class-db.php#L64.
RemediationAI
No vendor-released patch was identified at time of analysis. The primary remediation is to disable and remove the Payamito SMS WooCommerce plugin until a fixed version is available. As a compensating control, restrict access to the vulnerable endpoint that processes the 'columns' parameter to trusted IP addresses, but this may break legitimate functionality for remote users. Deploy a web application firewall (WAF) with virtual patching rules targeting SQL injection in the 'columns' parameter, though time-based blind attacks may evade simple pattern matching. Monitor for repeated requests with unusual delays and high database load that could indicate exploitation attempts. The Wordfence threat intel page (https://www.wordfence.com/threat-intel/vulnerabilities/id/75de6387-fac7-403d-9e6c-89570658d978?source=cve) may provide additional guidance or virtual patching for Wordfence users. No exact fix version numbers are available from the input data.
More in Woocommerce
View allThe WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.
Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victi
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today