CVE-2026-15205: 
WordPress Analyse et atténuation des vulnérabilités

CVE-2026-15205 is an unauthenticated SQL injection vulnerability in the Paymob for WooCommerce WordPress plugin affecting all versions before 4.1.9. The flaw exists in the plugin's public payment callback endpoint, where a client-supplied identifier is used in a SQL query without proper sanitization and before HMAC signature verification is performed. This allows unauthenticated attackers to read arbitrary data from the database, including user credentials and other secrets, via both in-band (reflected) and time-based blind SQL injection techniques. It was publicly disclosed on August 12, 2026, with the CVE record published on August 14, 2026, and carries a CVSS score of 8.6 (High) per WPScan (WPScan, GitHub Advisory).

The root cause is improper neutralization of special elements used in a SQL command (CWE-89), where a client-controlled identifier passed to the Paymob payment callback endpoint is interpolated directly into a SQL query without sanitization. Critically, the SQL query is executed before the plugin verifies the payment provider's HMAC signature, meaning the authentication bypass is inherent to the flawed processing order — no valid credentials or signed request are required to trigger the injection. Both in-band (reflected) and time-based blind extraction techniques are viable attack paths. A proof-of-concept is scheduled for public release on August 26, 2026, per WPScan's coordinated disclosure timeline (WPScan).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary data from the WordPress database, including WordPress user credentials (hashed passwords), secret keys, API tokens, and other sensitive configuration data stored in the database. This data exposure can facilitate account takeover, privilege escalation to administrator, and further compromise of the WordPress site and potentially the underlying server. The vulnerability is classified as a File/Data Disclosure impact and is reachable via a public, unauthenticated HTTP endpoint, maximizing its exposure surface (WPScan, GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit available, though WPScan has indicated a PoC will be released on August 26, 2026. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is currently 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the unauthenticated nature of the attack vector and the accessibility of the payment callback endpoint make this vulnerability highly attractive for opportunistic exploitation once a PoC is published (WPScan, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the Paymob for WooCommerce plugin (versions < 4.1.9) using tools like WPScan, Shodan, or Google dorks targeting plugin-specific file paths (e.g., inurl:/wp-content/plugins/paymob-for-woocommerce/).
2. Locate the callback endpoint: Identify the public, unauthenticated Paymob payment callback URL exposed by the plugin (typically a REST API or webhook endpoint registered by the plugin).
3. Craft a malicious request: Send an HTTP request to the callback endpoint with a crafted identifier parameter containing a SQL injection payload (e.g., a UNION-based payload for in-band extraction or a time-based blind payload using SLEEP() or BENCHMARK()).
4. In-band extraction: Use a UNION SELECT payload to retrieve data directly in the HTTP response, targeting tables such as wp_users (for usernames and password hashes) and wp_options (for secret keys and API tokens).
5. Blind extraction (if in-band is blocked): Use time-based blind injection (e.g., IF(condition, SLEEP(5), 0)) to infer database contents character by character, automating with tools like sqlmap.
6. Credential cracking and escalation: Crack retrieved WordPress password hashes offline (MD5-based phpass) and use recovered credentials to log in as an administrator, enabling full site takeover (WPScan).

• Network: Unusual HTTP POST or GET requests to the Paymob payment callback endpoint (e.g., paths containing paymob, callback, or webhook under /wp-json/ or /?wc-api=) with anomalous or encoded identifier parameters containing SQL syntax (e.g., UNION, SELECT, SLEEP, BENCHMARK, ', --).
• Logs: WordPress or web server access logs showing repeated requests to the Paymob callback endpoint from a single IP or range with varying payloads; HTTP 200 responses to callback requests that lack valid HMAC signatures.
• Database: Unexpected or high-frequency SQL queries against wp_users or wp_options tables originating from the web process; database error logs showing SQL syntax errors related to the callback handler.
• File System: New or modified PHP files in /wp-content/plugins/paymob-for-woocommerce/ or other plugin directories that may indicate post-exploitation web shell placement.
• Process: Unusual outbound connections from the web server process following callback requests, which may indicate data exfiltration or follow-on exploitation (WPScan).

The primary remediation is to update the Paymob for WooCommerce plugin to version 4.1.9 or later, which addresses the SQL injection by properly sanitizing the client-supplied identifier before use in SQL queries. As a temporary workaround prior to patching, administrators should implement Web Application Firewall (WAF) rules to block requests containing SQL injection patterns (e.g., UNION, SELECT, SLEEP, BENCHMARK) targeting the Paymob callback endpoint. Additionally, restricting access to the callback endpoint by IP allowlist (to Paymob's known IP ranges) can reduce exposure until the patch is applied (WPScan, GitHub Advisory).

The vulnerability was discovered and reported by researcher Artus KG, who also submitted it to WPScan. WPScan has verified the vulnerability and is following a coordinated disclosure timeline, withholding the full proof-of-concept until August 26, 2026, to allow site owners time to update. No significant broader media coverage or notable social media commentary has been identified beyond standard vulnerability database aggregation (WPScan).