CVE-2025-13077

Name of the Vulnerable Software and Affected Versions payamito sms woocommerce plugin for WordPress versions prior to 1.3.6

Description An issue exists where unauthenticated attackers can perform time-based blind SQL Injection. This occurs due to insufficient escaping of the user-supplied columns parameter and a lack of proper preparation of the SQL query. This flaw allows attackers to append additional SQL queries to existing ones to extract sensitive information from the database. Time-based blind SQL Injection is a technique used to infer data from a database by observing the time it takes for the server to respond to specific queries.

Recommendations Update the plugin to a version newer than 1.3.5. As a temporary mitigation, restrict access to the functionality utilizing the columns parameter.