CVE-2020-14092: 
WordPress vulnerability analysis and mitigation

The CodePeople Payment Form for PayPal Pro plugin versions before 1.1.65 for WordPress contained an unauthenticated SQL Injection vulnerability. The vulnerability was discovered and disclosed on July 2, 2020, affecting websites using this WordPress payment processing plugin (NVD, CVE).

The vulnerability existed in the 'query' parameter which allowed unauthenticated users to perform SQL queries with results output to a web page in JSON format. A proof of concept demonstrated that attackers could access database contents through URLs like 'https://example.com/?cffaction=get_data_from_database&query=SELECT%20*%20from%20wp_posts'. The vulnerability received a CVSS score of 9.1 (Critical), indicating its severe nature (WPScan).

The SQL injection vulnerability could allow unauthorized users to access, modify, or extract sensitive information from the WordPress database, potentially compromising user data, payment information, and other critical website content (WPScan).

The vulnerability was classified as an unauthenticated SQL injection, meaning it could be exploited without requiring any form of authentication. The attack vector was relatively simple to execute, requiring only the manipulation of URL parameters (WPScan).

The vulnerability was patched in version 1.1.65 of the plugin. Website administrators using affected versions should immediately update to version 1.1.65 or later to protect against this security risk (WordPress).