CVE-2026-103307: Walletdoc Payment Gateway SQLi Vulnerability

CVE-2026-103307 Overview

CVE-2026-103307 affects the Walletdoc Payment Gateway for WooCommerce WordPress plugin in versions prior to 1.8.5. The plugin fails to sanitize and escape user input before using it in SQL statements, enabling unauthenticated SQL injection [CWE-89]. A second flaw compounds the risk: the payment webhook verifies requests using a signing secret that is empty by default. Unauthenticated attackers can therefore forge webhook calls to mark arbitrary WooCommerce orders as paid. The combination exposes merchant databases to extraction and enables fraudulent order fulfillment without payment.

Critical Impact
Unauthenticated attackers can extract database contents via SQL injection and manipulate order payment status without authentication, resulting in financial loss and data exposure.

Affected Products

Walletdoc Payment Gateway for WooCommerce WordPress plugin versions before 1.8.5
WordPress sites running WooCommerce with the vulnerable Walletdoc integration
Merchant storefronts relying on Walletdoc webhook-based payment confirmation

Discovery Timeline

2026-10-14 - CVE-2026-103307 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-103307

Vulnerability Analysis

The advisory describes two distinct weaknesses in the same plugin. The first is a SQL injection flaw where user-supplied input is passed into a SQL statement without proper sanitization or parameterization. An unauthenticated attacker can supply crafted input to the vulnerable endpoint and alter the structure of the query. This permits extraction of arbitrary database rows, including customer records and administrator credentials stored by WordPress.

The second weakness lies in the payment webhook handler. The handler validates incoming webhook payloads against a signing secret. Because the secret is empty by default, any attacker who can reach the webhook endpoint over the network can submit a forged payload that passes signature validation. The handler then updates the referenced WooCommerce order to a paid status.

Root Cause

The SQL injection results from direct interpolation of untrusted request parameters into a SQL query string without using WordPress prepared statements such as $wpdb->prepare(). The webhook bypass stems from an insecure default configuration: the signing secret field ships blank, and the verification routine treats an empty-secret comparison as valid rather than rejecting the request.

Attack Vector

Both issues are reachable over the network without authentication or user interaction. An attacker sends crafted HTTP requests directly to the plugin's public endpoints. For the SQL injection, malicious payloads are placed in the vulnerable request parameter to exfiltrate data. For the webhook abuse, the attacker posts a crafted JSON payload referencing a target order ID, and the plugin marks the order as paid. Refer to the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-103307

Indicators of Compromise

WooCommerce orders transitioning to a paid status with no corresponding entry in the Walletdoc merchant dashboard or settlement logs.
HTTP POST requests to the Walletdoc webhook endpoint from IP addresses outside Walletdoc's published source ranges.
Web server access logs containing SQL metacharacters such as UNION SELECT, SLEEP(, or -- in parameters handled by the Walletdoc plugin.
Unexpected database read errors or long query times originating from wp-content/plugins/walletdoc-payment-gateway/ code paths.

Detection Strategies

Audit WordPress plugin inventories to identify sites running Walletdoc Payment Gateway for WooCommerce below version 1.8.5.
Deploy web application firewall rules that flag SQL injection patterns targeting Walletdoc plugin endpoints.
Compare WooCommerce order status change events against Walletdoc transaction confirmations to surface mismatches.

Monitoring Recommendations

Enable WordPress audit logging for order status transitions and plugin option changes.
Forward web server, PHP error, and WordPress logs to a centralized analytics platform for correlation with payment events.
Alert on repeated 500 responses or anomalous parameter lengths against plugin REST and admin-ajax endpoints.

How to Mitigate CVE-2026-103307

Immediate Actions Required

Update the Walletdoc Payment Gateway for WooCommerce plugin to version 1.8.5 or later on all WordPress instances.
Configure a non-empty webhook signing secret in the plugin settings and rotate the value in the Walletdoc merchant portal.
Review recent WooCommerce orders for fraudulent paid status changes and reverse fulfillment where appropriate.
Rotate WordPress administrator passwords and database credentials if SQL injection exploitation is suspected.

Patch Information

The vendor addressed both issues in Walletdoc Payment Gateway for WooCommerce 1.8.5. The patched release introduces proper parameterization for SQL queries and enforces a non-empty signing secret for webhook signature validation. Full details are available in the WPScan Vulnerability Report.

Workarounds

Deactivate the Walletdoc plugin until it can be upgraded to 1.8.5 or later.
Restrict access to the plugin's webhook endpoint using web server access control lists limited to Walletdoc source IP ranges.
Deploy virtual patching rules at the WAF layer to block SQL injection payloads and unsigned webhook requests targeting the plugin.

bash

# Example WAF rule concept to restrict webhook endpoint by source IP
location ~ /wp-json/walletdoc/ {
    allow 192.0.2.0/24;    # Replace with Walletdoc published ranges
    deny all;
}