Gopay For Woocommerce
Monthly
SQL injection in the GoPay for WooCommerce WordPress plugin (all versions up to and including 1.0.36) lets an attacker who already holds a Shop Manager or higher role inject extra SQL through the 'log_table_filter' parameter handled by the plugin's admin log view, allowing retrieval of sensitive data from the site's database (rated C:H/I:N/A:N, CVSS 4.9, authenticated with PR:H). The vulnerable code sits in an admin-area screen, so unauthenticated or low-privileged users cannot reach the parameter, and the practical threat is limited to insiders, rogue store staff, or sessions of already-compromised privileged accounts. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation (CISA KEV).
SQL injection in the GoPay for WooCommerce WordPress plugin (all versions up to and including 1.0.36) lets an attacker who already holds a Shop Manager or higher role inject extra SQL through the 'log_table_filter' parameter handled by the plugin's admin log view, allowing retrieval of sensitive data from the site's database (rated C:H/I:N/A:N, CVSS 4.9, authenticated with PR:H). The vulnerable code sits in an admin-area screen, so unauthenticated or low-privileged users cannot reach the parameter, and the practical threat is limited to insiders, rogue store staff, or sessions of already-compromised privileged accounts. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation (CISA KEV).