PT-2026-6041 · WordPress · Sibs Woocommerce Payment Gateway Plugin

Daniel Basta + 1 · Publicado 2026-02-04 · Atualizado 2026-02-04 · CVE-2026-1370

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SIBS woocommerce payment gateway plugin for WordPress versions up to and including 2.2.0

Description The SIBS woocommerce payment gateway plugin for WordPress is susceptible to time-based SQL Injection via the referencedId parameter. This is due to inadequate escaping of user-supplied input and insufficient preparation of the existing SQL query. Successful exploitation allows authenticated attackers with Administrator-level access or higher to inject additional SQL queries into existing ones, potentially extracting sensitive information from the database.

Recommendations Versions prior to and including 2.2.0 should be updated.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-1370

Produtos afetados

Sibs Woocommerce Payment Gateway Plugin

Referências · 4

• https://plugins.trac.wordpress.org/browser/sibs-woocommerce/tags/2.2.0/class-sibs-payment-gateway.php#L1855 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/eac8e81c-2f6f-4a4a-9678-f5d75f4954ae?source=cve · Nota
• https://t.me/CVEtracker/43711 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-1370 · Nota de Segurança