The vulnerability arises in the Paymob for WooCommerce WordPress plugin before version 4.1.9 where a client‑supplied identifier is used directly in a SQL query inside a public, unauthenticated payment callback. This operation is performed before validating the payment provider’s HMAC signature, enabling an attacker to inject arbitrary SQL. The result is the ability to read any data stored in the database, including user credentials and other secrets, through both in‑band (reflected) and time‑based blind extraction techniques. The weakness corresponds to CWE‑89: Improper Neutralization of Special Elements used in an SQL Command.

Any WordPress site that has the Paymob for WooCommerce plugin installed with a version earlier than 4.1.9 is affected. The attack surface is the public payment‑callback endpoint exposed by the plugin, which does not require authentication or proper request validation.

The absence of an EPSS score suggests that exploitation frequency is not publicly quantified, but the lack of any KEV listing indicates no confirmed exploit has been reported in the CISA catalog as of this data dump. Nevertheless, the combination of unauthenticated access, unsanitised input, and no pre‑verification of a cryptographic signature presents a high‑risk scenario. An attacker needs only to craft a crafted HTTP request to the callback endpoint; no prior authentication or compromise is required. Once the injection succeeds, arbitrary database content can be exfiltrated, potentially exposing sensitive secrets or user information. The CVSS score is not provided, but based on the described impact and attack vector, the severity would likely be considered high.