CVE-2026-103307 — Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhook

CVE-2026-103307

Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhook PUBLISHED

Description (CNA)

The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL injection attacks and to mark arbitrary orders as paid.

Affected (CNA)

Vendor / product	Versions
Unknown / Walletdoc Payment Gateway for WooCommerce	affected 0 before 1.8.5

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/4e67fefd-56d9-4bfd-9e19-a2b5fff1e7a2/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.