Plataforma
c
Componente
woo-altcoin-payment-gateway
Corregido en
1.7.7
CVE-2025-26535 describes a critical SQL Injection vulnerability discovered in the CodeSolz Bitcoin / AltCoin Payment Gateway for WooCommerce plugin. This flaw allows attackers to perform blind SQL injection, potentially leading to unauthorized data access and manipulation. The vulnerability affects versions from 0.0.0 up to and including 1.7.6. A patch has been released in version 1.7.7.
The SQL Injection vulnerability in the WooCommerce AltCoin Payment Gateway allows an attacker to bypass security measures and directly interact with the underlying database. Because this is a blind SQL injection, the attacker must infer the data by observing the application's response to various SQL queries. This can be a time-consuming process, but successful exploitation can lead to the extraction of sensitive information such as customer details, transaction history, and potentially even database credentials. The attacker could also modify data, leading to financial losses or reputational damage. While no specific real-world exploitation has been publicly reported, the severity of the vulnerability and the potential for data exfiltration make it a significant risk.
CVE-2025-26535 was publicly disclosed on March 3, 2025. It is not currently listed on the CISA KEV catalog. Public proof-of-concept exploits are not widely available, but the vulnerability's severity and the ease of exploitation (blind SQL injection) suggest a potential for future exploitation. The NVD entry was published on the same date as the public disclosure.
WooCommerce store owners who have installed the CodeSolz Bitcoin / AltCoin Payment Gateway plugin and are running versions 0.0.0 through 1.7.6 are at significant risk. Shared hosting environments where multiple stores share the same database are particularly vulnerable, as a successful attack on one store could potentially compromise others.
• wordpress / composer / npm:
grep -r "CodeSolz Bitcoin / AltCoin Payment Gateway" /var/www/html/wp-content/plugins/
wp plugin list | grep altcoin-payment-gateway• generic web:
curl -I https://your-wordpress-site.com/wp-content/plugins/altcoin-payment-gateway/ | grep -i 'SQL Injection'disclosure
Estado del Exploit
EPSS
0.23% (46% percentil)
CISA SSVC
Vector CVSS
The primary mitigation for CVE-2025-26535 is to immediately upgrade the WooCommerce AltCoin Payment Gateway plugin to version 1.7.7 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) with rules to filter potentially malicious SQL injection attempts targeting the plugin's endpoints. Specifically, look for patterns involving single quotes, double quotes, and SQL keywords in user-supplied input. Additionally, review and restrict database user permissions to limit the impact of a successful SQL injection attack. After upgrade, confirm the vulnerability is resolved by attempting a SQL injection payload on a non-critical endpoint.
Actualice el plugin Bitcoin / AltCoin Payment Gateway for WooCommerce a la última versión disponible para mitigar la vulnerabilidad de inyección SQL ciega. Verifique las actualizaciones en el repositorio de WordPress o en el sitio web del desarrollador. Implemente medidas de seguridad adicionales, como la validación y el saneamiento de las entradas del usuario, para prevenir futuras vulnerabilidades.
Análisis de vulnerabilidades y alertas críticas directamente en tu correo.
CVE-2025-26535 is a critical SQL Injection vulnerability affecting the WooCommerce AltCoin Payment Gateway plugin, allowing attackers to potentially extract sensitive data from the database.
If you are using WooCommerce AltCoin Payment Gateway versions 0.0.0 through 1.7.6, you are affected by this vulnerability.
Upgrade the WooCommerce AltCoin Payment Gateway plugin to version 1.7.7 or later to resolve the vulnerability. Consider WAF rules as an interim measure.
While no active exploitation has been publicly confirmed, the vulnerability's severity makes it a potential target for attackers.
Refer to the CodeSolz website and the WooCommerce plugin repository for official advisories and updates related to CVE-2025-26535.
Sube tu archivo de dependencias y detecta esta y otras CVEs al instante.