CVE-2025-9463

The PeachPay Payments Plugin for WooCommerce (versions up to and including 1.117.5) contains a time-based SQL injection vulnerability in the order_by parameter [1]. The root cause is insufficient escaping of user-supplied input and lack of proper preparation in the existing SQL query, enabling an attacker to inject arbitrary SQL clauses [1].

Exploitation requires authenticated access with at least Subscriber-level privileges [1]. The attacker can manipulate the order_by parameter to append additional SQL queries into already existing database queries, leveraging time-based techniques to infer information from the database response delays [1]. No other special network access or privileges are necessary beyond valid WordPress credentials with Subscriber role or higher [1].

Successful exploitation allows an attacker to extract sensitive information from the WordPress database, such as user credentials, session tokens, or other confidential data stored by the site [1]. The time-based SQL injection method relies on conditional delays to exfiltrate data bit by bit, making extraction feasible albeit slower than direct retrieval [1].

The plugin vendor has not yet released a patched version as of the CVE publication date [1]. Administrators are advised to restrict Subscriber-level access to trusted users only, monitor database query logs for unusual time-based patterns, and apply any future security updates promptly [1].