SQL Injection Vulnerability in PagBank / PagSeguro Connect for WooCommerce Plugin

CVE-2025-10142

What is CVE-2025-10142?

The PagBank / PagSeguro Connect para WooCommerce plugin for WordPress is susceptible to an SQL Injection exploit through the 'status' parameter. This vulnerability arises from inadequate sanitation of user-supplied input, allowing authenticated users with Shop Manager-level privileges or higher to inject additional SQL commands. This can lead to unauthorized access and extraction of sensitive data from the database, posing a significant security risk to affected sites. Prompt updates to versions beyond 4.44.3 are recommended to mitigate this issue.

References