What is the CVSS score of CVE-2026-56036?

CVE-2026-56036 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of SimplePay for WooCommerce are affected by CVE-2026-56036?

The SimplePay WordPress payment plugin (pgall-for-woocommerce version 5.5.6 and earlier) contains a critical unauthenticated SQL injection vulnerability that enables remote attackers to directly…

How to fix or mitigate CVE-2026-56036?

24 hours: Immediately disable pgall-for-woocommerce on all WordPress instances; identify affected sites and restrict database user permissions for payment functions. 7 days: Complete migration to an alternative, actively maintained payment gateway (Stripe, Square, or PayPal Commerce); conduct forensic review of database access logs and payment records for unauthorized access dating back 30 days. 30 days: Finalize plugin replacement and decommissioning; remediate any identified unauthorized access; update incident response procedures and security controls.

SimplePay for WooCommerce CVE-2026-56036

EUVD-2026-39699 CRITICAL

SQL Injection (CWE-89)

2026-06-26 audit@patchstack.com

GHSA-m96r-cgp3-44h2

WordPress SQLi Wordpress Plugin

9.3

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.2 HIGH

Unauthenticated network-reachable SQLi gives AV:N/AC:L/PR:N/UI:N with C:H for full DB read; I:L for possible write, A:N, and scope unchanged as impact stays within the app's own database.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:44 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions.

AnalysisAI

Unauthenticated SQL injection in the WordPress payment plugin 워드프레스 결제 심플페이 (SimplePay / pgall-for-woocommerce) version 5.5.6 and earlier lets remote attackers inject arbitrary SQL against the WooCommerce database without any authentication or user interaction. Per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N), exploitation is trivial and network-reachable, with high confidentiality impact and a changed scope. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The flaw is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) defect: user-controlled input reaches a database query without proper parameterization or escaping. The affected component is a Korean-market WooCommerce payment-gateway plugin for WordPress (slug pgall-for-woocommerce, branded 결제 심플페이 / SimplePay), which integrates checkout and payment processing into the WooCommerce/WordPress data layer. Because WooCommerce stores customer, order, and credential-adjacent data in the shared WordPress MySQL database, an injection point in a payment plugin exposes the entire site database, not just the plugin's own tables. No CPE string was supplied by the source, so the exact affected configuration is identified only by the plugin slug and version bound (<= 5.5.6).

RemediationAI

No vendor-released patch version was identified in the available data, so a confirmed fixed release cannot be cited - monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/pgall-for-woocommerce/vulnerability/wordpress-plugin-5-5-6-sql-injection-vulnerability) and the plugin's update channel for a release above 5.5.6 and upgrade as soon as one is published. Until a patched version is confirmed, the most effective compensating control is to deactivate and remove the pgall-for-woocommerce plugin, which stops checkout via this gateway but eliminates the injection path entirely; if the gateway must remain live, place a WAF/virtual patch in front of WordPress with SQL-injection rules targeting the plugin's request parameters (Patchstack and most WAF vendors ship such rules), accepting that WAF rules can be bypassed and are only a stopgap. Additionally restrict the plugin's endpoints at the web-server or firewall layer where feasible and ensure the WordPress database account follows least privilege to limit the blast radius of a successful read.