WordPress Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop plugin <= 1.7.6 - SQL Injection vulnerability

The SQL Injection vulnerability in the WooCommerce AltCoin Payment Gateway allows an attacker to bypass security measures and directly interact with the underlying database. Because this is a blind SQL injection, the attacker must infer the data by observing the application's response to various SQL queries. This can be a time-consuming process, but successful exploitation can lead to the extraction of sensitive information such as customer details, transaction history, and potentially even database credentials. The attacker could also modify data, leading to financial losses or reputational damage. While no specific real-world exploitation has been publicly reported, the severity of the vulnerability and the potential for data exfiltration make it a significant risk.

WooCommerce store owners who have installed the CodeSolz Bitcoin / AltCoin Payment Gateway plugin and are running versions 0.0.0 through 1.7.6 are at significant risk. Shared hosting environments where multiple stores share the same database are particularly vulnerable, as a successful attack on one store could potentially compromise others.

• wordpress / composer / npm:

grep -r "CodeSolz Bitcoin / AltCoin Payment Gateway" /var/www/html/wp-content/plugins/
wp plugin list | grep altcoin-payment-gateway

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/altcoin-payment-gateway/ | grep -i 'SQL Injection'

1. 2025-03-03Disclosure

   disclosure

1. आरक्षित2025-02-12
2. प्रकाशित2025-03-03
3. संशोधित2026-04-28
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2025-26535 is to immediately upgrade the WooCommerce AltCoin Payment Gateway plugin to version 1.7.7 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) with rules to filter potentially malicious SQL injection attempts targeting the plugin's endpoints. Specifically, look for patterns involving single quotes, double quotes, and SQL keywords in user-supplied input. Additionally, review and restrict database user permissions to limit the impact of a successful SQL injection attack. After upgrade, confirm the vulnerability is resolved by attempting a SQL injection payload on a non-critical endpoint.