The Walletdoc Payment Gateway for WooCommerce plugin before version 1.8.5, classified as CWE-89, fails to properly sanitize user input used in SQL statements and verifies its payment webhook with an empty signing secret, allowing unauthenticated attackers to inject arbitrary SQL commands and to mark any order as paid.

Any WordPress site using the Walletdoc Payment Gateway for WooCommerce plugin less than version 1.8.5 is affected. The vulnerability is specific to the plugin’s database interactions and its webhook handling within WooCommerce, regardless of WordPress core or other plugins.

The EPSS score is below 1%, indicating a low current exploitation probability, but the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 8.6 indicates high severity. Based on the description, the likely attack vector is through unauthenticated HTTP requests targeting the plugin’s database interactions, or forged payment webhooks due to the empty signing secret. Inferred from the vulnerability details, an attacker could exploit these vectors to inject SQL or mark orders as paid. The lack of authentication on the webhook endpoint means no access control barriers exist, making the attack path straightforward for anyone who discovers the vulnerable plugin.