CVE-2025-28942CWE-89

WordPress Trust Payments Gateway for WooCommerce plugin <= 1.1.4 - SQL Injection vulnerability

Critical ยท published March 26, 2025

CVSS v3.1
9.3
EPSS
1%
Percentile
49.0
In the wild
Unconfirmed
What it is

๐Ÿšจ One poorly sanitized input is all it takes for an attacker to unleash chaos in your database! ๐Ÿ˜ฑ Think of this vulnerability as a restaurant that lets customers slip in extra toppings on their pizza order without checking โ€” you might end up with some truly unexpected ingredients! ๐Ÿ• With the ability to execute arbitrary SQL commands, an attacker could not only read, modify, or delete records in your database but could also compromise sensitive customer data and disrupt operations entirely. The ramifications could be absolutely devastating for your business and customer trust!

Put simply

Think of this vulnerability as a restaurant that lets customers slip in extra toppings on their pizza order without checking โ€” you might end up with some truly unexpected ingredients! ๐Ÿ• This SQL Injection vulnerability in the Trust Payments Gateway for WooCommerce allows attackers to manipulate SQL commands due to improper neutralization of special elements in user inputs, letting them gain unauthorized access.

What to do

With the ability to execute arbitrary SQL commands, an attacker could not only read, modify, or delete records in your database but could also compromise sensitive customer data and disrupt operations entirely. The ramifications could be absolutely devastating for your business and customer trust! Immediately update the Trust Payments Gateway for WooCommerce to version 1.1.5 or higher to eliminate this vulnerability. Additionally, implement prepared statements and parameterized queries to safeguard against future SQL injections. Regularly audit your input validation processes to ensure proper sanitization! You've got this! By taking swift action, you'll be on your way to bolstering security like a pro! ๐Ÿ›ก๏ธ

The record
Technical detail
CVSS v3.1
9.3 ยท CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00620 ยท 49.0th percentile
Weakness
CWE-89 ยท Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-03-26T14:24Z
EPSS history
Timeline
  • 26 MAR 14:24Z
    WordPress Trust Payments Gateway for WooCommerce plugin <= 1.1.4 - SQL Injection vulnerability
    cvelistv5