CVE-2024-0610 – The Piraeus Bank WooCommerce Payment Gateway pl... (How to Fix)

Q: What is the severity of CVE-2024-0610?

CVE-2024-0610 has a CVSS score of 9.8 (CRITICAL). The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is vulnerable to time-based blind SQL injection via the 'MerchantReference' parameter. This allows unauthenticated attackers to extract sensitive information from the database. All WordPress sites using this plugin up to version 1.6.5.1 are affected.

📋 TL;DR

The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is vulnerable to time-based blind SQL injection via the 'MerchantReference' parameter. This allows unauthenticated attackers to extract sensitive information from the database. All WordPress sites using this plugin up to version 1.6.5.1 are affected.

💻 Affected Systems

Products:

Piraeus Bank WooCommerce Payment Gateway plugin for WordPress

Versions: All versions up to and including 1.6.5.1

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: All WordPress installations with this plugin enabled are vulnerable regardless of configuration.

📦 What is this software?

Piraeus Bank Woocommerce Payment Gateway by Papaki

View all CVEs affecting Piraeus Bank Woocommerce Payment Gateway →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise including sensitive customer data, payment information, and administrative credentials leading to full site takeover.

🟠

Likely Case

Extraction of sensitive data such as user credentials, payment details, and personal information from the database.

🟢

If Mitigated

Limited or no data exposure if proper input validation and prepared statements are implemented.

🌐 Internet-Facing: HIGH

🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Time-based blind SQL injection requires more sophisticated exploitation but automated tools exist.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Versions after 1.6.5.1

Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3035641%40woo-payment-gateway-for-piraeus-bank&new=3035641%40woo-payment-gateway-for-piraeus-bank&sfp_email=&sfph_mail=

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'WooCommerce Payment Gateway for Piraeus Bank'. 4. Click 'Update Now' if available. 5. Alternatively, download latest version from WordPress repository and replace plugin files.

🔧 Temporary Workarounds

Disable Plugin

all

Temporarily disable the vulnerable plugin until patched.

wp plugin deactivate woo-payment-gateway-for-piraeus-bank

Web Application Firewall

all

Implement WAF rules to block SQL injection attempts on MerchantReference parameter.

🧯 If You Can't Patch

Disable the Piraeus Bank payment gateway plugin immediately.
Implement network-level filtering to block SQL injection patterns targeting the MerchantReference parameter.

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel > Plugins > Installed Plugins for 'WooCommerce Payment Gateway for Piraeus Bank' version 1.6.5.1 or earlier.

Check Version:

wp plugin get woo-payment-gateway-for-piraeus-bank --field=version

Verify Fix Applied:

Verify plugin version is higher than 1.6.5.1 in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual SQL queries containing MerchantReference parameter
Multiple failed database queries with timing delays
Requests with SQL injection patterns in MerchantReference

Network Indicators:

HTTP POST requests to payment gateway endpoints with SQL syntax in parameters
Unusual timing patterns in responses

SIEM Query:

source="web_logs" AND (MerchantReference CONTAINS "' OR" OR MerchantReference CONTAINS "SLEEP" OR MerchantReference CONTAINS "BENCHMARK")

📊 Metadata

CVE ID: CVE-2024-0610

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-89

Published: February 17, 2024

Last Updated: February 26, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-0610, you might also want to check these: