CVE-2025-26535
Published: 03 March 2025
Summary
CVE-2025-26535 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-26535 is an Improper Neutralization of Special Elements used in an SQL Command vulnerability, classified as CWE-89, that enables Blind SQL Injection in the CodeSolz Bitcoin / AltCoin Payment Gateway for WooCommerce plugin (woo-altcoin-payment-gateway). This WordPress plugin, which facilitates cryptocurrency payments, is affected in all versions from n/a through 1.7.6. The issue was published on 2025-03-03 with a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), indicating critical severity due to its high confidentiality impact and changed scope.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction or privileges required. By injecting malicious SQL payloads, they can perform blind SQL injection to extract sensitive data from the database, achieving high confidentiality impact while causing low integrity and availability disruption.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/woo-altcoin-payment-gateway/vulnerability/wordpress-bitcoin-altcoin-payment-gateway-for-woocommerce-multivendor-store-shop-plugin-1-7-6-sql-injection-vulnerability?_s_id=cve provides detailed information on the vulnerability specific to version 1.7.6 in the WordPress plugin context.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5631
Vulnerability details
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CodeSolz Bitcoin / AltCoin Payment Gateway for WooCommerce woo-altcoin-payment-gateway allows Blind SQL Injection.This issue affects Bitcoin / AltCoin Payment Gateway for WooCommerce: from n/a through <=…
more
1.7.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing WordPress plugin enables remote exploitation of the application (T1190) for blind extraction of sensitive database data (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validating and sanitizing untrusted inputs to the WooCommerce plugin to neutralize special elements in SQL commands, preventing blind SQL injection exploitation.
Mandates timely identification, reporting, and patching of the specific SQL injection flaw (CVE-2025-26535) in the woo-altcoin-payment-gateway plugin versions through 1.7.6.
Requires ongoing vulnerability scanning to identify the blind SQL injection vulnerability in the WordPress plugin, enabling proactive remediation before exploitation.