High Security Advisory Disclosed 2026-10-26
Identity withheld until 2027-01-24 (90 days). The maintainer/vendor was notified on 2026-10-26 and has a 90-day window to remediate before the affected software is named. This page is unlisted and not indexed until then. codelake never stores raw secrets.
Advisory · CLR-2026-3685

SQL injection in a WordPress payments and top-up plugin — admin transaction manager without nonces

The admin transaction manager concatenates request input into unprepared queries with no nonce protection, making the sinks CSRF-steerable; a public payment callback is constructively unsafe. The vendor will be notified under a 90-day coordinated-disclosure window; details are revealed automatically on the reveal date.

HighCoordinated disclosure
Summary

a WordPress payments and top-up plugin builds transaction-management SQL by string concatenation. The admin-facing transaction editor interpolates trans_id and editable fields directly into $wpdb calls without prepare() and without any nonce — an administrator's browser can be steered (CSRF) into executing attacker SQL. A public payment callback is constructively unsafe although practically gated by panel credentials. The affected release is current release.

Site owners should restrict access to the plugin's admin pages until a fix ships.

Technical detail
🔒
Technical detail withheld until 2027-01-24 (90 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.
Remediation
🔒
Technical detail withheld until 2027-01-24 (90 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.

Reported by codelake Research (https://research.codelake.dev) under coordinated disclosure. The affected software's identity and the exact technical detail are withheld until the reveal date to limit exploitation of an unpatched issue, then revealed automatically.