All vulnerabilities
CVE-2026-103307

Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhook

Unknown Walletdoc Payment Gateway for WooCommerceNetwork & edge
Open in ThreatlineRecord JSON
CVSS
8.6High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 26% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.8.5Fixed versionCVE List
Published14 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

  • 1.8.5Walletdoc Payment Gateway for WooCommerceCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL injection attacks and to mark arbitrary orders as paid.

Text from CVE List

Affected versions 1

  • Walletdoc Payment Gateway for WooCommerceaffected: all versions before 1.8.5CVE List

References 1