rootpwn

medium · CVSS v3 4.9 · EPSS 0.00266

CVE-2026-75959

The GoPay for WooCommerce plugin for WordPress has a SQL injection vulnerability in the log_table_filter parameter. Authenticated shop manag

Overview

The GoPay for WooCommerce plugin for WordPress has a SQL injection vulnerability in the log_table_filter parameter. Authenticated shop managers can inject arbitrary SQL to read sensitive data. This affects all versions up to 1.0.36.

Description

The GoPay for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'log_table_filter' parameter in all versions up to, and including, 1.0.36 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Impact

Confidentiality: attackers can read database contents; Integrity: potential data tampering; Availability: not directly impacted. Defenders: site administrators, shop managers, security teams.

Remediation

Upgrade to version 1.0.37 or later. If upgrade is not possible, restrict log_table_filter to numeric values or whitelist allowed inputs. Apply web application firewall rules to block suspicious SQL patterns. Monitor database logs for anomalous queries.

Risk context

Medium severity, low EPSS (0.00266) indicates a low likelihood of exploitation, but patching should be performed promptly to mitigate potential data exposure.

Affected products

  • GoPay for WooCommerce
  • WooCommerce
  • WordPress

Scores

Severity
medium
CVSS v2
6.1
CVSS v3
4.9
CVSS v4
—
EPSS
0.00266

sql-injection wordpress plugin go-pay medium-severity wp-woocommerce database-exfiltration

← All CVEs

Related CVEs

medium

CVE-2026-93956

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component Search Engine. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 1.1.3 can resolve this issue. This patch is called 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

View analysis

medium

CVE-2026-93957

A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. This affects the function SearchEngine::matchesSingleFilter of the file src/SearchEngine.php of the component Filter Matching. The manipulation leads to incorrect comparison. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.4 is able to mitigate this issue. The identifier of the patch is 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

View analysis

medium

CVE-2026-18346

The TikTok plugin for WordPress (up to 1.4.1) contains an authorization bypass that lets unauthenticated users overwrite the stored TikTok access token. This can lead to hijacking of the site’s TikTok Business and product catalog integration. The flaw requires a valid TikTok OAuth auth_code but is otherwise easy to trigger.

View analysis

medium

CVE-2026-1256

The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to missing capability checks on popup management actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary popups and inject malicious JavaScript that executes when the popup is displayed, leading to Stored XSS.

View analysis