CVE-2026-75959: GoPay for WooCommerce <= 1.0.36 - Authenticated (Shop Manager+) SQL Injection via 'log_table_filter' Parameter
The GoPay for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'logtablefilter' parameter in all versions up to, and including, 1.0.36 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GoPay for WooCommerceto a version that resolves this vulnerability.Fixed in 1.0.36
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the WordPress site with a Shop Manager role or a higher-privileged role. Unauthenticated visitors and accounts below Shop Manager are not described as able to exploit it.
What access does exploitation provide?
The issue can allow an authenticated attacker to append SQL to an existing query and extract sensitive information from the WordPress database. The provided information does not indicate that it enables data modification or service disruption.
Which installations are affected?
GoPay for WooCommerce versions through 1.0.36, including 1.0.36, are affected. The vulnerable input is the log_table_filter parameter.