The affected plugin is vulnerable to a time‑based SQL injection that occurs through the order_by parameter. Because the application fails to escape or prepare the user supplied value, an attacker can append additional SQL statements to the existing query. This allows the extraction of sensitive data from the database. The weakness is a classic Injection flaw (CWE‑89).

The vulnerability applies to PeachPay — Payments & Express Checkout for WooCommerce, covering all releases up to and including version 1.117.5. Users running these versions are at risk; later releases address the flaw.

The flaw has a CVSS base score of 6.5, reflecting a moderate severity that permits information disclosure but does not necessarily allow arbitrary code execution. The EPSS score is below 1 %, indicating low current exploitation likelihood, and the vulnerability has not yet been listed in CISA’s KEV catalog. The attack requires authenticated access at the Subscriber level or higher, likely a contributor or higher role. Once authenticated, an attacker can manipulate the order_by parameter to inject and execute arbitrary SQL commands.