CVE-2025-9463

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 1.117.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Sep 10, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-94647.5A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. This vulnerability is triggered during fuzzi CVE-2025-94657.5A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensi CVE-2025-94667.5A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP CVE-2025-94675.3When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validatio CVE-2025-94689.8A security vulnerability has been detected in itsourcecode Apartment Management System 1.0. Affected by this vulnerability is an unknown fun CVE-2025-94699.8A vulnerability was detected in itsourcecode Apartment Management System 1.0. Affected by this issue is some unknown functionality of the fi CVE-2025-94709.8A flaw has been found in itsourcecode Apartment Management System 1.0. This affects an unknown part of the file /management/add_m_committee.CVE-2025-94719.8A vulnerability has been found in itsourcecode Apartment Management System 1.0. This vulnerability affects unknown code of the file /mainten CVE-2025-94729.8A vulnerability was found in itsourcecode Apartment Management System 1.0. This issue affects some unknown processing of the file /owner_uti CVE-2025-94739.8A security vulnerability has been detected in SourceCodester Online Bank Management System 1.0. This impacts an unknown function of the file CVE-2025-94744.5A vulnerability was detected in Mihomo Party up to 1.8.1 on macOS. Affected is the function enableSysProxy of the file src/main/sys/sysproxy CVE-2025-94759.8A flaw has been found in SourceCodester Human Resource Information System 1.0. Affected by this vulnerability is an unknown functionality of