CVE-2025-13077

The payamito sms woocommerce plugin for WordPress is vulnerable to time-based blind SQL injection in versions up to and including 1.3.5. The vulnerability exists because the plugin insufficiently escapes user-supplied input and does not adequately prepare SQL queries when processing the 'columns' parameter. This lack of proper input sanitization allows an attacker to inject arbitrary SQL commands into existing queries.

Exploitation can be performed by an unauthenticated attacker sending specially crafted requests that include malicious SQL payloads within the 'columns' parameter. Because the injection is time-based, the attacker can infer information from the database by observing response delays. No authentication is required to reach the vulnerable endpoint, making the attack surface widely accessible.

Successful exploitation enables an attacker to extract sensitive information from the WordPress database, such as user credentials, private data, or other configuration details. This type of SQL injection can lead to complete disclosure of database contents and potentially allow further attacks against the application [1].

As of the publication date, the vendor has not released a patched version beyond 1.3.5. Users are strongly advised to apply any available updates or implement input validation and parameterized queries as a workaround to prevent exploitation [1].