SQL Injection Vulnerability in Paymob for WooCommerce Plugin by WordPress
CVE-2026-15205

8.6HIGH

Key Information:

Vendor

WordPress
Status
Paymob For WooCommerce
Vendor
CVE Published:
14 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-15205?

The Paymob for WooCommerce plugin prior to version 4.1.9 fails to adequately sanitize a user-supplied identifier used in SQL queries within its public payment callback. This occurs before the payment provider's HMAC signature is verified. As a result, it exposes the plugin to SQL injection attacks, allowing unauthenticated users to execute arbitrary SQL commands. Attackers can exploit this flaw to extract sensitive data from the database, including user credentials and other confidential information, potentially through both in-band and time-based blind SQL injection methods.

Affected Version(s)

Paymob for WooCommerce 0 < 4.1.9

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-15205 - Proof of Concept

References

https://wpscan.com/vulnerability/cbde48bb-5aa4-4f69-8101-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Artus KG
WPScan
.