EUVD-2026-66993
GHSA-72jx-427r-9vg8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SQLi (AV:N/AC:L/PR:N/UI:N) yields high confidentiality via data theft and at least low integrity from possible data manipulation; I keep scope unchanged absent evidence the DB engine crosses a security authority.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.
AnalysisAI
SQL injection in the Epayco payment gateway WordPress plugin (versions 8.4.6 and earlier) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's request handling, per Patchstack's disclosure. Because the CVSS vector marks scope as changed with high confidentiality impact (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3), an attacker can read data beyond the plugin's own tables, potentially exposing WordPress user records and payment-related order data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that the Epayco gateway plugin (version 8.4.6 or earlier) be installed and active on a network-reachable WordPress site; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication, no privileges, and no user interaction are needed against a default installation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Multiple signals point to a genuinely high-priority issue rather than an inflated score: the CVSS 3.1 base is 9.3 driven by network vector, low complexity, no privileges and no user interaction (AV:N/AC:L/PR:N/UI:N), and a changed scope (S:C) with high confidentiality impact - a realistic profile for unauthenticated SQLi that can reach beyond the plugin's data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a crafted HTTP request with a malicious SQL payload to one of the plugin's unauthenticated endpoints, needing no account and no user interaction (AV:N/AC:L/PR:N/UI:N). The injected query executes against the WordPress database, allowing extraction of sensitive data such as user credentials or order/transaction records; with scope changed, the disclosure can reach data beyond the plugin's own tables. … |
| Remediation | Upgrade the Epayco gateway plugin to the vendor's fixed release once confirmed - the input does not specify an exact fix version beyond identifying 8.4.6 and earlier as vulnerable, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/epayco-gateway/vulnerability/wordpress-epayco-plugin-8-4-6-sql-injection-vulnerability) for the patched version and update to the latest available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: immediately deactivate and remove the vulnerable Epayco plugin from all WordPress installations running versions 8.4.6 and earlier; document the affected systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today