ClearSale Total <= 3.4.2 - Unauthenticated SQL Injection

An unauthenticated attacker sends a POST request to the WordPress AJAX endpoint with the action `clearsale_total_push` and a crafted `pagseguro[metodo]` parameter. Although the handler calls `wp_verify_nonce()`, the failing branch's `die()` is commented out, so execution continues regardless of nonce validity. On PHP < 8.0, the attacker-supplied string (e.g., `"4 AND SLEEP(5)"`) bypasses the `switch ($metodo)` guard via loose type juggling, because the string compares equal to integer `4`. The value is then interpolated directly into an unquoted `UPDATE wp_cs_total_dadosextras SET metodo=$metodo, ...` query, enabling SQL injection [CWE-89] [ref_id=2].

The vulnerability resides in the `clearsale_total_push` AJAX handler within `class-clearsale-total-ajax.php`. The handler is registered for both authenticated and unauthenticated users via `wp_ajax_nopriv_clearsale_total_push` and `wp_ajax_clearsale_total_push`. The `pagseguro[metodo]` POST parameter is used unsafely in a SQL query after a nonce check that fails silently (the `die()` call is commented out).

The advisory does not include a published patch. The recommended remediation is to ensure the `pagseguro[metodo]` value is validated as an integer before being used in the SQL query, to restore the `die()` call in the nonce verification failure branch, and to use prepared statements or proper quoting for all database queries. Without these changes, the vulnerability remains exploitable on PHP < 8.0.