## Summary
The Paymob for WooCommerce WordPress plugin (before 4.1.9) contains an unauthenticated SQL injection in its public payment callback. The plugin uses a client-supplied identifier in a SQL query without proper sanitization and executes the query before verifying the payment provider’s HMAC signature, enabling attackers to extract sensitive database contents.
## Technical Details
- Root issue: the plugin “does not properly sanitise a client-supplied identifier” before using it in a SQL query.
- Trust boundary failure: the SQL query is performed before verifying the payment provider’s HMAC signature.
- Exposure: the vulnerable callback is “public” and “unauthenticated,” allowing remote attackers to reach it.
- Exploitation impact: attackers can perform SQL injection to read arbitrary database data, including “user credentials and other secrets.”
- Data extraction methods mentioned:
- in-band (reflected) extraction
- time-based blind extraction
## Affected
- WordPress plugin: Paymob for WooCommerce
- Affected versions: versions before 4.1.9
- Fixed in: 4.1.9
## Impact
- Unauthenticated SQL injection (network-reachable, no privileges required)
- Confidentiality impact: high (read arbitrary data, including user credentials and other secrets)
- Integrity/availability impact: not indicated in the provided description (NVD vector shows I:N/A:N).
## Mitigation
1. Upgrade the plugin to 4.1.9 or later (the issue is fixed in 4.1.9).
2. If immediate upgrade is not possible, restrict access to the payment callback endpoint at the web layer (e.g., WAF/routing rules) to reduce unauthenticated reachability.
3. After patching, review logs for requests to the payment callback and any anomalous query patterns consistent with SQLi attempts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CWE-89