Unauthenticated SQL Injection in WooCommerce Payment Plugin

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows unauthenticated attackers to perform SQL injection and read arbitrary data from the database — including user credentials and other secrets — through both in-band (reflected) and time-based blind extraction.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Paymob for WooCommerce plugin contains a critical SQL injection vulnerability (CWE-89) in its payment callback handler that can be exploited by unauthenticated attackers. The flaw exists because the plugin fails to sanitize user-supplied identifiers before incorporating them into SQL queries, and critically, performs database queries before validating the HMAC signature from the payment provider. This means an attacker can bypass authentication entirely and extract sensitive data directly from the database, including user credentials, payment information, and other secrets. Any WordPress site running Paymob for WooCommerce versions prior to 4.1.9 is vulnerable, making this a high-risk issue affecting e-commerce operations globally.

Casky's 322 matching skills detect this attack pattern by analyzing techniques under TA0001 (Reconnaissance) and TA0043 (Exfiltration). Practitioners using Casky would identify suspicious indicators including: unauthenticated HTTP requests to payment callback endpoints with malicious SQL syntax in identifier parameters, time-based blind SQL injection attempts that cause unusual database query delays, and database queries executing before signature validation occurs. Claude's extended reasoning capabilities help correlate these signals to recognize the exploitation chain—initial reconnaissance of the callback endpoint structure, followed by SQL injection payloads designed for data exfiltration. Security teams would see findings flagging unsafe query construction patterns, missing input validation on public endpoints, and authentication bypass logic that prioritizes database operations over cryptographic verification, enabling rapid remediation before attackers harvest sensitive records.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-15205.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-15205

Casky has 322 skills that investigate the attack patterns behind CVE-2026-15205. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn