CVE-2025-9463: WooCommerce Payments Plugin SQL Injection

CVE-2025-9463 Overview

CVE-2025-9463 is a time-based SQL injection vulnerability in the PeachPay for WooCommerce plugin, a payments and checkout extension that integrates Stripe, PayPal, Square, and Authorize.net with WordPress. The flaw resides in the analytics module and affects all versions up to and including 1.117.5. Authenticated attackers with Subscriber-level access or higher can inject SQL fragments through the order_by request parameter. Successful exploitation allows extraction of sensitive data from the WordPress database, including user credentials, session tokens, and payment-related records.

Critical Impact
Authenticated attackers with low-privilege Subscriber accounts can extract arbitrary database contents from affected WooCommerce stores via time-based SQL injection.

Affected Products

PeachPay for WooCommerce plugin (peachpay-for-woocommerce) versions up to and including 1.117.5
WordPress installations running the vulnerable plugin
WooCommerce stores processing Stripe, PayPal, Square, or Authorize.net payments through PeachPay

Discovery Timeline

2025-09-10 - CVE-2025-9463 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9463

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw [CWE-89] located in the PeachPay analytics database handler at core/modules/analytics/class-peachpay-analytics-database.php. The plugin accepts the order_by parameter from user input and concatenates it into an SQL ORDER BY clause without sufficient escaping or use of a prepared statement.

Because data returned from an injected ORDER BY clause is not directly reflected to the user, attackers rely on time-based blind techniques. They infer query results by inducing conditional delays with functions such as SLEEP() and measuring server response time. Over many requests, this allows byte-by-byte extraction of arbitrary database contents.

The required privilege level is Subscriber, which is the lowest authenticated role in WordPress. Many WooCommerce stores allow open customer registration, which effectively lowers the exploitation barrier to any attacker able to create an account.

Root Cause

The vulnerable code path passes the order_by value directly into a dynamically constructed query. WordPress column and ordering identifiers cannot be bound through wpdb::prepare() placeholders, so the plugin should have validated the parameter against an allowlist of known-safe column names before concatenation. The absence of allowlist validation is the root cause.

Attack Vector

Exploitation requires network access to the WordPress site and valid Subscriber credentials. The attacker submits HTTP requests to the vulnerable analytics endpoint with a crafted order_by value containing an SQL expression that triggers a conditional delay. By scripting many such requests, the attacker enumerates table contents including the wp_users table and payment metadata. No user interaction and no administrative access are required.

Technical details of the vulnerable code are available in the WordPress PeachPay Analytics Code and the corresponding WordPress PeachPay Changeset that remediates the issue.

Detection Methods for CVE-2025-9463

Indicators of Compromise

HTTP requests to PeachPay analytics endpoints containing order_by values with SQL keywords such as SLEEP, BENCHMARK, UNION, SELECT, IF(, or CASE WHEN.
Repeated requests from the same authenticated Subscriber account showing systematically increasing response times.
Unusual query patterns in wp_users or wp_usermeta access logs that correlate with low-privilege account activity.
New or recently created Subscriber accounts generating high request volumes against WooCommerce admin or analytics endpoints.

Detection Strategies

Enable MySQL slow query logging and alert on queries containing ORDER BY clauses with conditional expressions originating from the PeachPay module.
Deploy Web Application Firewall (WAF) rules that inspect the order_by parameter for SQL metacharacters and time-delay functions.
Correlate authentication logs with request bursts from newly registered Subscriber-level accounts.

Monitoring Recommendations

Monitor outbound response times for PeachPay analytics endpoints and alert on statistical anomalies.
Audit WordPress user roles regularly and flag unexpected account creation patterns.
Forward WordPress, PHP, and MySQL logs to a centralized SIEM for cross-source correlation of injection attempts.

How to Mitigate CVE-2025-9463

Immediate Actions Required

Update the PeachPay for WooCommerce plugin to a version later than 1.117.5 that includes the fix referenced in the vendor changeset.
Audit WordPress user accounts and remove unexpected Subscriber accounts created during the exposure window.
Rotate WordPress administrator passwords, API keys, and payment gateway credentials that may have been exposed through the database.
Review WooCommerce order and customer data for signs of unauthorized read access.

Patch Information

The vendor addressed the issue in a WordPress.org changeset for the peachpay-for-woocommerce repository. Site administrators should install the latest release available from the WordPress PeachPay Plugin Page. Additional analysis is documented in the Wordfence Vulnerability Report.

Workarounds

Temporarily disable the PeachPay for WooCommerce plugin until it can be updated.
Disable open user registration in WordPress settings to remove the low-privilege attacker entry point.
Deploy a WAF rule that blocks requests containing SQL time-delay functions in the order_by parameter.
Restrict access to WordPress administrative and analytics endpoints by IP where feasible.

bash

# Example WAF rule concept (ModSecurity) to block time-based SQLi in order_by
SecRule ARGS:order_by "@rx (?i)(sleep\s*\(|benchmark\s*\(|union\s+select|case\s+when|if\s*\()" \
    "id:1009463,phase:2,deny,status:403,log,\
    msg:'Potential SQL injection in order_by (CVE-2025-9463)'"