Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2026-103307: Walletdoc WooCommerce gateway lets attackers alter orders and database
CVE-2026-103307 · published 21 days ago
Summary
The Walletdoc Payment Gateway for WooCommerce plugin versions before 1.8.5 can be tricked into running unwanted commands on your site’s database and can be fooled into marking any order as paid. This happens because the plugin does not properly clean incoming data and uses an empty secret to verify payment notifications. Update the plugin to version 1.8.5 or later, or apply the vendor’s fix, and ensure the webhook secret is set to a strong value.
What to do
- Update unknown walletdoc payment gateway for woocommerce to version 1.8.5 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | walletdoc payment gateway for woocommerce | < 1.8.5 |
Original advisory text
Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhook
The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL injection attacks and to mark arbitrary orders as paid.
Severity
8.6
High
Type
CWE-89SQL Injection
Timeline
Published14 Oct 2026
Updated4 Nov 2026
First seen14 Oct 2026
Track software like this
Free during beta