CVE-2026-103307 Walletdoc CVE debrief

Who should care

Defenders responsible for maintaining and securing WooCommerce installations with the Walletdoc Payment Gateway plugin should assess exposure and prioritize updating to version 1.8.5 or later.

Why it matters

Defenders should care about this vulnerability as it allows unauthenticated attackers to perform SQL injection attacks and mark arbitrary orders as paid, potentially leading to financial losses and data breaches. Affected roles include WooCommerce administrators and defenders responsible for maintaining and securing WooCommerce installations with the Walletdoc Payment Gateway plugin. The vulnerability requires verification of plugin versions and exposure, as well as prioritization of updates to version 1.8.5 or later.

• Potential SQL injection attacks
• Order payment forgery via webhook
• Unauthenticated access to sensitive data
• Possible financial losses due to arbitrary order payments

Technical summary

The Walletdoc Payment Gateway for WooCommerce plugin before version 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default. This allows unauthenticated attackers to perform SQL injection attacks and mark arbitrary orders as paid. The vulnerability requires verification of plugin versions and exposure, as well as prioritization of updates to version 1.8.5 or later. Defenders should prioritize updating the plugin to version 1.8.5 or later to prevent exploitation.

Defensive priority

Defenders should prioritize updating the plugin to version 1.8.5 or later to prevent exploitation.

Recommended defensive actions

• Update the Walletdoc Payment Gateway for WooCommerce plugin to version 1.8.5 or later
• Review and restrict access to the plugin's webhook functionality
• Monitor for suspicious SQL queries and order payment activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected plugin version and potential attack vectors. The vulnerability allows unauthenticated attackers to perform SQL injection attacks and mark arbitrary orders as paid. The source item provides additional information on the vulnerability, and defenders should verify plugin versions and exposure. The CVE Program record and NVD detail page provide official information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.