A critical SQL injection vulnerability in the Paymob for WooCommerce plugin allows unauthenticated attackers to potentially compromise sensitive database information.

This is an SQL injection vulnerability (CWE-89) arising from insufficient sanitization of user-supplied input. It allows an unauthenticated remote attacker to execute arbitrary SQL commands against the WordPress database.

Successful exploitation allows an attacker to bypass authentication, extract sensitive customer data, or modify database contents. Given the CVSS score of 8.6, this vulnerability poses a significant risk to data confidentiality and integrity, potentially leading to regulatory compliance failures and severe reputational damage.

Immediate Action: Update the Paymob for WooCommerce plugin to version 4.1.9 or higher immediately.

Proactive Monitoring: Review database query logs for anomalous patterns or unexpected syntax that may indicate automated SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns to provide temporary protection while the update is staged.

Public Exploit Available: Unknown

This high-severity vulnerability requires immediate attention due to the ease of exploitation. Administrators must prioritize updating the plugin to the latest version to prevent unauthorized data access and potential database manipulation.