CVE-2024-6205: PayPlus Payment Gateway < 6.6.9 - Unauthenticated SQLi

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-07-19 · updated 2026-06-17
Weakness: CWE-89

Description

The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated users, leading to an SQL injection vulnerability.

Affected products

PayPlus Payment Gateway: before 6.6.9 — fixed in 6.6.9

How to fix

Upgrade to a fixed version: PayPlus Payment Gateway 6.6.9. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/7e2c5032-2917-418c-aee3-092bdb78a087/
https://wpscan.com/vulnerability/7e2c5032-2917-418c-aee3-092bdb78a087/

Get alerted when CVE-2024-6205 or the next vulnerability affects your stack