Executive brief
The Paymob for WooCommerce plugin is a payment gateway integration for WooCommerce stores that processes Paymob payment callbacks. A flaw in the plugin allows unauthenticated attackers to extract sensitive data—including WordPress user login credentials and password hashes—directly from the database by injecting SQL code into payment callback requests, without needing a valid account or legitimate payment authorization.
Technical details
The vulnerability is an unauthenticated SQL injection in the payment callback handler (wc-api=paymob_callback). The plugin fails to sanitize the merchant_order_id (accept branch) or merchant_intention_id (flash branch) parameters before using them in a SQL query. Critically, this vulnerable query executes before HMAC signature verification, making the attack vector completely network-accessible to unauthenticated attackers. Exploitation is possible through both in-band reflection (error messages reveal query results) and time-based blind techniques (SLEEP delays confirm SQL conditions). An attacker can extract arbitrary database contents, including WordPress user credentials and configuration secrets. The vulnerability affects versions before 4.1.9; a patch is available.
Affected products
- Paymob Paymob for WooCommerce before 4.1.9
Timeline
- 2026-08-12: disclosed
- 2026-08-14: patched: version 4.1.9 available