Walletdoc Payment Gateway For Woocommerce
Monthly
Unauthenticated attackers can exploit the Walletdoc Payment Gateway for WooCommerce plugin before version 1.8.5 to execute SQL injection and forge payment webhooks, marking arbitrary WooCommerce orders as paid. The webhook signature check uses a signing secret that is empty by default, so any default installation is vulnerable; the SQL injection works without authentication or user interaction. Publicly available exploit code exists, but EPSS is low (0.21%, 11th percentile) and CISA SSVC indicates no observed exploitation; the vendor has released patch version 1.8.5.
Unauthenticated attackers can exploit the Walletdoc Payment Gateway for WooCommerce plugin before version 1.8.5 to execute SQL injection and forge payment webhooks, marking arbitrary WooCommerce orders as paid. The webhook signature check uses a signing secret that is empty by default, so any default installation is vulnerable; the SQL injection works without authentication or user interaction. Publicly available exploit code exists, but EPSS is low (0.21%, 11th percentile) and CISA SSVC indicates no observed exploitation; the vendor has released patch version 1.8.5.