Platform
c
Component
woo-altcoin-payment-gateway
Fixed in
1.7.7
CVE-2025-26535 describes a critical SQL Injection vulnerability discovered in the CodeSolz Bitcoin / AltCoin Payment Gateway for WooCommerce plugin. This flaw allows attackers to perform blind SQL injection, potentially leading to unauthorized data access and manipulation. The vulnerability affects versions from 0.0.0 up to and including 1.7.6. A patch has been released in version 1.7.7.
The SQL Injection vulnerability in the WooCommerce AltCoin Payment Gateway allows an attacker to bypass security measures and directly interact with the underlying database. Because this is a blind SQL injection, the attacker must infer the data by observing the application's response to various SQL queries. This can be a time-consuming process, but successful exploitation can lead to the extraction of sensitive information such as customer details, transaction history, and potentially even database credentials. The attacker could also modify data, leading to financial losses or reputational damage. While no specific real-world exploitation has been publicly reported, the severity of the vulnerability and the potential for data exfiltration make it a significant risk.
CVE-2025-26535 was publicly disclosed on March 3, 2025. It is not currently listed on the CISA KEV catalog. Public proof-of-concept exploits are not widely available, but the vulnerability's severity and the ease of exploitation (blind SQL injection) suggest a potential for future exploitation. The NVD entry was published on the same date as the public disclosure.
Exploit Status
EPSS
0.23% (46% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-26535 is to immediately upgrade the WooCommerce AltCoin Payment Gateway plugin to version 1.7.7 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) with rules to filter potentially malicious SQL injection attempts targeting the plugin's endpoints. Specifically, look for patterns involving single quotes, double quotes, and SQL keywords in user-supplied input. Additionally, review and restrict database user permissions to limit the impact of a successful SQL injection attack. After upgrade, confirm the vulnerability is resolved by attempting a SQL injection payload on a non-critical endpoint.
Update the Bitcoin / AltCoin Payment Gateway for WooCommerce plugin to the latest available version to mitigate the blind SQL injection vulnerability. Check for updates in the WordPress repository or on the developer's website. Implement additional security measures, such as user input validation and sanitization, to prevent future vulnerabilities.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-26535 is a critical SQL Injection vulnerability affecting the WooCommerce AltCoin Payment Gateway plugin, allowing attackers to potentially extract sensitive data from the database.
If you are using WooCommerce AltCoin Payment Gateway versions 0.0.0 through 1.7.6, you are affected by this vulnerability.
Upgrade the WooCommerce AltCoin Payment Gateway plugin to version 1.7.7 or later to resolve the vulnerability. Consider WAF rules as an interim measure.
While no active exploitation has been publicly confirmed, the vulnerability's severity makes it a potential target for attackers.
Refer to the CodeSolz website and the WooCommerce plugin repository for official advisories and updates related to CVE-2025-26535.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.