SQL Injection Vulnerability in Walletdoc Payment Gateway for WooCommerce
CVE-2026-103307
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 14 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-103307?
The Walletdoc Payment Gateway for WooCommerce plugin prior to version 1.8.5 is susceptible to SQL injection due to inadequate sanitization and escaping of user input within SQL statements. Additionally, it lacks a secure payment webhook verification as its signing secret is set to empty by default. This oversight permits unauthenticated attackers to execute SQL injection attacks, potentially allowing them to manipulate order statuses and mark any orders as paid without authorization.
Affected Version(s)
Walletdoc Payment Gateway for WooCommerce 0 < 1.8.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.