Skip to content
CVE PROGRAM SOURCE RECORD7.6 High

CVE-2024-6205

PayPlus Payment Gateway < 6.6.9 - Unauthenticated SQLi

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated users, leading to an SQL injection vulnerability.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown PayPlus Payment Gateway

Default version status: unaffected

  • 0 to < 6.6.9affected

References