Walletdoc Payment Gateway CVE-2026-103307

The site must run the Walletdoc Payment Gateway for WooCommerce plugin at a version before 1.8.5 on WordPress/WooCommerce. The SQL injection requires no authentication, user interaction, or non-default configuration (AV:N/AC:L/PR:N/UI:N) - it works against default installs. The order-marking bypass is enabled specifically because the payment webhook's signing secret is EMPTY BY DEFAULT, so any deployment where an operator has not manually configured a signing secret is exploitable; configuring a non-empty secret limits the webhook-forgery path. Realistic limiting factor: the plugin's small deployment base, not any technical precondition.

Signals conflict and should be weighed carefully. The CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) reflects a network-reachable, unauthenticated, low-complexity flaw with a scope change and high confidentiality impact - on paper a serious issue, and a public exploit exists (WPScan) with a vendor patch available. However, exploitation-likelihood signals are modest: EPSS is only 0.21% (11th percentile), the vulnerability is NOT in CISA KEV, and SSVC records Exploitation as 'none' (no observed active exploitation) with Technical Impact 'partial' - notably lower than the 'high confidentiality' the CVSS vector implies. SSVC Automatable 'yes' is the main escalator, consistent with scriptable WordPress-plugin SQLi scanning. Two distinct weaknesses are bundled: an unauthenticated SQL injection (CWE-89) and a payment-webhook authentication bypass caused by an empty default signing secret that lets an attacker mark arbitrary orders as paid. The official vector scores I:N, which appears to understate the business-logic/integrity impact of fraudulently marking orders paid - verify with WPScan, as this is a real integrity concern for merchants even if NVD modeled only the SQLi confidentiality impact. Net assessment: a credible, automatable flaw worth prompt patching for anyone running this specific plugin, but the low EPSS, absence from KEV, and SSVC 'none' indicate this is not currently mass-exploited; real-world priority is bounded primarily by the plugin's limited deployment footprint rather than by exploit difficulty.

An unauthenticated attacker sends a crafted HTTP request with malicious SQL to a vulnerable plugin endpoint, exfiltrating order/customer data from the WordPress/WooCommerce database; separately, because the payment webhook ships with an empty signing secret by default, the attacker forges a webhook callback to mark their own unpaid orders as paid, obtaining goods without payment. A public exploit/advisory from WPScan exists, and the AV:N/AC:L/PR:N/UI:N profile means the attack needs no authentication, user interaction, or special timing.