PatchSiren cyber security CVE debrief
CVE-2026-8705 clearsale CVE debrief
The ClearSale Total plugin for WordPress is vulnerable to SQL Injection via the `pagseguro[metodo]` POST parameter of the `clearsale_total_push` AJAX action in all versions up to, and including, 3.4.2. The handler is registered for unauthenticated users, and although a `wp_verify_nonce()` check exists, the failing branch's `die()` is commented out so execution continues regardless of nonce validity. On PHP < 8.0 the attacker-supplied `$metodo` value bypasses the `switch ($metodo) { case 4: ... }` guard via loose type juggling, reaching an unquoted `UPDATE wp_cs_total_dadosextras SET metodo=$metodo, ...` query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the target server to be running PHP < 8.0.
- Vendor
- clearsale
- Product
- ClearSale Total
- CVSS
- HIGH 7.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-24
- Original CVE updated
- 2026-06-25
- Advisory published
- 2026-06-24
- Advisory updated
- 2026-06-25
Who should care
WordPress administrators and users of the ClearSale Total plugin should be aware of this vulnerability and take immediate action to update to a patched version. Additionally, security teams and threat hunters should monitor for potential exploitation attempts.
Technical summary
The ClearSale Total plugin for WordPress is vulnerable to SQL Injection via the `pagseguro[metodo]` POST parameter of the `clearsale_total_push` AJAX action. The vulnerability exists due to a flawed `wp_verify_nonce()` check and the use of loose type juggling in PHP < 8.0. This allows unauthenticated attackers to inject malicious SQL queries and potentially extract sensitive information from the database.
Defensive priority
High priority should be given to updating the ClearSale Total plugin to a patched version. Additionally, security teams should monitor for potential exploitation attempts and implement compensating controls to detect and prevent SQL injection attacks.
Recommended defensive actions
- Update the ClearSale Total plugin to a patched version
- Monitor for potential exploitation attempts
- Implement compensating controls to detect and prevent SQL injection attacks
- Perform a thorough review of the plugin's code and configuration
- Consider implementing additional security measures such as web application firewalls and intrusion detection systems
Evidence notes
The vulnerability was reported by [email protected] and is publicly disclosed in the CVE-2026-8705 record. The ClearSale Total plugin is used by WordPress sites to integrate with the ClearSale payment gateway. The vulnerability affects all versions up to 3.4.2 and requires PHP < 8.0 to exploit.
Official resources
This article is AI-assisted and based on the supplied source corpus.