SQL Injection Vulnerability in WooCommerce Payments Plugin for WordPress

CVE-2025-9463

What is CVE-2025-9463?

The Payments Plugin for WooCommerce, including multiple gateways like Stripe, PayPal, Square, and Authorize.net, is susceptible to a time-based SQL Injection vulnerability. This issue arises from inadequate escaping of user-supplied parameters in the ‘order_by’ segment, present in all plugin versions up to 1.117.5. An authenticated attacker with at least Subscriber-level access can exploit this flaw. By appending arbitrary SQL queries to existing queries, they can potentially extract sensitive data from the database, posing a significant risk to user information and overall system security.

References