EUVD-2026-66993
GHSA-72jx-427r-9vg8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Epayco plugin
-
DeliverySend crafted request to unauthenticated endpoint
-
ExploitInject SQL into database query
-
ExecutionExtract user and transaction data
-
ImpactExfiltrate sensitive records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only that the Epayco gateway plugin (version 8.4.6 or earlier) be installed and active on a network-reachable WordPress site; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication, no privileges, and no user interaction are needed against a default installation. The primary limiting factor is that the site must actually run this specific plugin, which is a regional (Epayco/Colombian) payment integration and therefore not universally deployed; there is no indication of a required non-default configuration, but the exact vulnerable endpoint/parameter is not named in the provided data, so an attacker must locate the injectable input. |
| Impact | Multiple signals point to a genuinely high-priority issue rather than an inflated score: the CVSS 3.1 base is 9.3 driven by network vector, low complexity, no privileges and no user interaction (AV:N/AC:L/PR:N/UI:N), and a changed scope (S:C) with high confidentiality impact - a realistic profile for unauthenticated SQLi that can reach beyond the plugin's data. The vector's I:N and A:L are conservative for SQLi (many injection flaws allow data modification), so the practical impact could be understated; verify against the vendor advisory. Counterbalancing the severity, there is no CISA KEV listing and no POC referenced, so there is currently no evidence of active exploitation - treat this as urgent-to-patch but not yet confirmed weaponized. EPSS was not provided in the input, so probabilistic exploitation likelihood cannot be quantified here; given the low complexity and pre-auth reach, any operator running this plugin - from a large e-commerce site to a mid-sized shop - should treat this as urgent and patch promptly. |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP request with a malicious SQL payload to one of the plugin's unauthenticated endpoints, needing no account and no user interaction (AV:N/AC:L/PR:N/UI:N). The injected query executes against the WordPress database, allowing extraction of sensitive data such as user credentials or order/transaction records; with scope changed, the disclosure can reach data beyond the plugin's own tables. No public POC is referenced at this time, so exploitation would require the attacker to independently identify the vulnerable parameter. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 27, 2026
SQL injection in the Epayco payment gateway WordPress plugin (versions 8.4.6 and earlier) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's request handling, per Patchstack's disclosure. Because the CVSS vector marks scope as changed with high confidentiality impact (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3), an attacker can read data beyond the plugin's own tables, potentially exposing WordPress user records and payment-related order data. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the pre-authentication network reachability makes it a high-priority patching target for any site running the plugin.
RemediationAI
Upgrade the Epayco gateway plugin to the vendor's fixed release once confirmed - the input does not specify an exact fix version beyond identifying 8.4.6 and earlier as vulnerable, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/epayco-gateway/vulnerability/wordpress-epayco-plugin-8-4-6-sql-injection-vulnerability) for the patched version and update to the latest available. Until patched, deploy a WAF or virtual patch (Patchstack and comparable WordPress firewalls typically ship a rule for disclosed plugin SQLi) to filter injection payloads against the plugin's endpoints; note this adds a dependency and may not cover all payload encodings. As a stronger compensating control, deactivate the Epayco gateway plugin if the payment integration can be temporarily disabled, accepting the trade-off that checkout via Epayco will stop working; alternatively restrict access to the plugin's callback/AJAX endpoints to Epayco's known source IP ranges, which may break legitimate payment confirmations if the processor uses other addresses.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Epayco payment gateway plugin for WordPress (CPE cpe:2.3:a:epayco:epayco:*), which integrates the Epayco/ePayco Colombian payment processor into WooCommerce/WordPress checkout flows. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input reaches a database query without proper parameterization or escaping - typically an unsanitized request parameter concatenated into a WHERE clause in the plugin's PHP handlers. Payment gateway plugins commonly expose AJAX/callback or webhook endpoints (e.g. IPN/confirmation handlers) that are reachable without authentication so the payment processor can post transaction results, which is a frequent source of unauthenticated injection surface in this class of plugin.
Know when Epayco gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SQLi (AV:N/AC:L/PR:N/UI:N) yields high confidentiality via data theft and at least low integrity from possible data manipulation; I keep scope unchanged absent evidence the DB engine crosses a security authority.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.
Executive ViewAI
Epayco payment gateway WordPress plugin versions 8.4.6 and earlier contain a critical SQL injection vulnerability (CVE-2026-78260, CVSS 9.3) remotely exploitable by unauthenticated attackers with no required user interaction. Any organization running this plugin faces direct risk of data breach exposing WordPress user accounts, customer records, and payment-related order information. Immediate deactivation of the plugin is required because no vendor patch is currently available.
Immediately deactivate the vulnerable plugin. Deploy Web Application Firewall rules to detect and block SQL injection payloads targeting the payment processing endpoints. Enable verbose database query logging and alert on suspicious SQL patterns. Implement least-privilege database user permissions. Segment payment processing systems from general infrastructure. Monitor WordPress admin audit logs for unauthorized access and account creation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB