Cyber Posture

CVE-2025-26535

Critical

Published: 03 March 2025

Published
03 March 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
EPSS Score 0.0004 11.0th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may leverage databases to mine valuable information.

Security Summary

CVE-2025-26535 is an Improper Neutralization of Special Elements used in an SQL Command vulnerability, classified as CWE-89, that enables Blind SQL Injection in the CodeSolz Bitcoin / AltCoin Payment Gateway for WooCommerce plugin (woo-altcoin-payment-gateway). This WordPress plugin, which facilitates cryptocurrency payments, is affected in all versions from n/a through 1.7.6. The issue was published on 2025-03-03 with a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), indicating critical severity due to its high confidentiality impact and changed scope.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction or privileges required. By injecting malicious SQL payloads, they can perform blind SQL injection to extract sensitive data from the database, achieving high confidentiality impact while causing low integrity and availability disruption.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/woo-altcoin-payment-gateway/vulnerability/wordpress-bitcoin-altcoin-payment-gateway-for-woocommerce-multivendor-store-shop-plugin-1-7-6-sql-injection-vulnerability?_s_id=cve provides detailed information on the vulnerability specific to version 1.7.6 in the WordPress plugin context.

Details

CWE(s)
CWE-89

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
Why these techniques?

SQL injection in public-facing WordPress plugin enables remote exploitation of the application (T1190) for blind extraction of sensitive database data (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References