CVE-2024-6205
📋 TL;DR
This vulnerability allows unauthenticated attackers to execute arbitrary SQL commands on WordPress sites using the PayPlus Payment Gateway plugin before version 6.6.9. The SQL injection occurs via a WooCommerce API endpoint that doesn't properly sanitize user input. Any WordPress site with the vulnerable plugin version is affected.
💻 Affected Systems
- PayPlus Payment Gateway WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, remote code execution, and full site takeover.
Likely Case
Database information disclosure, including sensitive payment data, user credentials, and site configuration.
If Mitigated
Limited impact if proper WAF rules block SQL injection patterns and database permissions are restricted.
🎯 Exploit Status
SQL injection via unauthenticated API endpoint makes exploitation trivial for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.6.9
Vendor Advisory: https://wpscan.com/vulnerability/7e2c5032-2917-418c-aee3-092bdb78a087/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find PayPlus Payment Gateway. 4. Click 'Update Now' if available. 5. Alternatively, download version 6.6.9+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable vulnerable API endpoint
allTemporarily disable the WooCommerce API route used in the exploit
Add to wp-config.php: define('DISABLE_WOOCOMMERCE_API', true);
Web Application Firewall rule
allBlock SQL injection patterns targeting the vulnerable endpoint
WAF-specific rules to block SQL injection patterns in API requests
🧯 If You Can't Patch
- Disable the PayPlus Payment Gateway plugin immediately
- Implement strict network controls to limit access to the WooCommerce API
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → PayPlus Payment Gateway version numberCheck Version:
wp plugin list --name='PayPlus Payment Gateway' --field=versionVerify Fix Applied:
Confirm plugin version is 6.6.9 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed API requests with SQL syntax
- Unexpected database errors
Network Indicators:
- HTTP POST requests to /wp-json/wc/v3/ endpoints with SQL payloads
- Unusual traffic patterns to WooCommerce API
SIEM Query:
source="web_logs" AND (uri="*wc/v3*" AND (request_body="*SELECT*" OR request_body="*UNION*" OR request_body="*OR 1=1*"))