Executive brief
The Music Store is a popular WordPress eCommerce plugin used by online retailers to sell digital and physical products. Versions before 1.4.5 contain a critical SQL injection vulnerability in the PayPal payment handler that allows attackers to inject malicious SQL commands without authentication, potentially exposing or modifying the store's customer database, payment records, and inventory data.
Technical details
The vulnerability is a classic SQL injection (CWE-89) in the PayPal data handler component, where user input is directly concatenated into SQL queries without sanitization or prepared statements. The flaw is exploitable by unauthenticated attackers via network access to the plugin's PayPal webhook or form handler. An attacker can craft malicious input to extract sensitive data (customer information, payment records), modify database contents, or potentially execute operating system commands depending on database permissions. The vulnerability was patched in version 1.4.5.
Affected products
- The Music Store The Music Store before 1.4.5
Timeline
- 2026-09-03: disclosed
- 2026-09-05: patched: Fixed in version 1.4.5