Description
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an incoming webhook request before using it in a SQL query, allowing users able to obtain the webhook secret (administrators) to perform SQL injection attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Razorpay for WooCommerce | < 4.8.9 | 4.8.9 |
References
- https://wpscan.com/vulnerability/723a8b8f-1215-47a6-a6f7-7796ce38e7c1/ exploit vdb-entry technical-description