SQL Injection Vulnerability in Paymob for WooCommerce Plugin by WordPress
CVE-2026-15205
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 14 August 2026
Badges
What is CVE-2026-15205?
The Paymob for WooCommerce plugin prior to version 4.1.9 fails to adequately sanitize a user-supplied identifier used in SQL queries within its public payment callback. This occurs before the payment provider's HMAC signature is verified. As a result, it exposes the plugin to SQL injection attacks, allowing unauthenticated users to execute arbitrary SQL commands. Attackers can exploit this flaw to extract sensitive data from the database, including user credentials and other confidential information, potentially through both in-band and time-based blind SQL injection methods.
Affected Version(s)
Paymob for WooCommerce 0 < 4.1.9
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.