High Security Advisory Disclosed 2026-10-26 · 11:12 UTC
Identity withheld until 2027-01-24 (90 days). The maintainer/vendor was notified on 2026-10-26 and has a 90-day window to remediate before the affected software is named. This page is unlisted and not indexed until then. codelake never stores raw secrets.
Advisory · CLR-2026-3682

SQL injection in a WordPress cryptocurrency payment-gateway plugin — guest/customer and admin contexts

Multiple unprepared SQL sinks in order-display, payment-status and order-cancellation code paths allow SQL injection from guest/customer contexts and from the admin order screen. Verified in the current release 1.1.8. Because payment state is writable, impact includes order manipulation. The vendor will be notified under a 90-day coordinated-disclosure window; details are revealed automatically on the reveal date.

HighCoordinated disclosure
Summary

a WordPress cryptocurrency payment-gateway plugin builds order and payment-status queries by concatenating request parameters (only sanitize_text_field() applied) into $wpdb calls without prepare(). Sinks are reachable from the WooCommerce thank-you page in guest/customer context and from the admin order meta box. For a payment plugin, writable order state is especially sensitive. The affected releases are all current versions.

Site owners should update to the newest release and verify; the current-release audit is in progress.

Technical detail
🔒
Technical detail withheld until 2027-01-24 (90 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.
Remediation
🔒
Technical detail withheld until 2027-01-24 (90 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.

Reported by codelake Research (https://research.codelake.dev) under coordinated disclosure. The affected software's identity and the exact technical detail are withheld until the reveal date to limit exploitation of an unpatched issue, then revealed automatically.