WooCommerce Payment Gateway SQL Injection and Webhook Authentication Bypass

The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL injection attacks and to mark arbitrary orders as paid.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Walletdoc Payment Gateway plugin for WooCommerce contains a critical SQL injection vulnerability (CWE-89) combined with an authentication bypass in its webhook verification mechanism. Attackers can exploit improper input sanitization to inject malicious SQL commands directly into database queries, while simultaneously bypassing webhook authentication due to an empty default signing secret. This vulnerability affects any WordPress installation using the vulnerable Walletdoc plugin versions before 1.8.5, putting e-commerce sites at risk of data exfiltration, unauthorized order manipulation, and potential payment fraud. The combination of these two weaknesses creates a particularly dangerous attack surface, as adversaries can not only extract sensitive customer and transaction data but also arbitrarily mark orders as paid without legitimate payment authorization.

Casky's 323 matched skills help practitioners detect the attack patterns underlying this vulnerability through Claude AI's extended reasoning across MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance via HTTP/HTTPS activity). Security teams would identify SQL injection attempts through pattern detection of suspicious SQL syntax in HTTP POST parameters destined for payment processing endpoints, along with anomalous webhook requests lacking proper cryptographic signatures. Practitioners would observe findings showing unauthenticated access to payment confirmation endpoints, unusual database query patterns in application logs, and orders marked as paid without corresponding gateway API calls. The skill mapping would surface both the initial reconnaissance phase where attackers probe the webhook endpoint for authentication weaknesses, and the exploitation phase where malformed SQL statements appear in request payloads—enabling defenders to correlate these attack chains and implement layered defenses including input validation, parameterized queries, and cryptographic webhook verification.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-103307.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-103307

Casky has 323 skills that investigate the attack patterns behind CVE-2026-103307. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn