EUVD-2026-83552
GHSA-88c4-2f34-57h5
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Network-reachable admin feature (AV:N/AC:L), but the injection point is gated behind Shop Manager+ capability (PR:H); read-only data extraction yields C:H with I:N/A:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The GoPay for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'log_table_filter' parameter in all versions up to, and including, 1.0.36 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL injection in the GoPay for WooCommerce WordPress plugin (all versions up to and including 1.0.36) lets an attacker who already holds a Shop Manager or higher role inject extra SQL through the 'log_table_filter' parameter handled by the plugin's admin log view, allowing retrieval of sensitive data from the site's database (rated C:H/I:N/A:N, CVSS 4.9, authenticated with PR:H). The vulnerable code sits in an admin-area screen, so unauthenticated or low-privileged users cannot reach the parameter, and the practical threat is limited to insiders, rogue store staff, or sessions of already-compromised privileged accounts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated session with Shop Manager-level capability or higher on the WordPress/WooCommerce site - the plugin's admin log view (admin/views/log.php) that consumes the 'log_table_filter' parameter is an admin-area feature not reachable by unauthenticated or low-privileged users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a high-CVSS-component (C:H) but low-real-world-priority issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch is identified in the available data, so the primary action is to monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/aa27c758-f02b-4120-bf66-b310720161b4) and the plugin's Trac repository (https://plugins.trac.wordpress.org/browser/gopay-gateway) for a release above 1.0.36 and apply it immediately when published; if the plugin is not essential, deactivating and removing it eliminates the exposure entirely. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Woocommerce
View allThe WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.
Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victi
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today