CVE-2026-75959

Name of the Vulnerable Software and Affected Versions GoPay for WooCommerce versions prior to 1.0.37

Description An issue exists where authenticated attackers with shop manager-level access or higher can perform a generic SQL Injection. This occurs because the plugin fails to sufficiently escape the user-supplied log table filter parameter and lacks proper preparation of the SQL query. This flaw allows attackers to append additional SQL queries to existing ones to extract sensitive information from the database.

Recommendations Update GoPay for WooCommerce to version 1.0.37 or later. As a temporary mitigation, restrict access to the log table filter parameter for users with shop manager-level permissions.