CVE-2024-6205 is a critical SQL injection in the PayPlus Payment Gateway plugin for WordPress, scored 9.8 in the record. The flaw is reachable without logging in through a WooCommerce API route. The plugin is fixed in version 6.6.9, so update to that release or newer and check your database activity.
What's affected
The record says the PayPlus Payment Gateway plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement. The route is a WooCommerce API route that unauthenticated users can reach. The plugin slug used by the WPScan entry is payplus-payment-gateway, and that entry lists 6.6.9 as the fixed version.
The weakness class is CWE-89, SQL injection. The vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which means network reachable, low complexity, no privileges and no user interaction.
Severity differs between sources. The record scores it 9.8 (Critical). The WPScan entry rates the same flaw 8.6 (High). Both agree on the fixed version, so the scoring gap does not change what you should do. Treat it as urgent either way, because any internet-facing store with the plugin active can be probed by anyone.
The record does not say the flaw is exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog. WPScan shows it was published on 2024-06-28, and the NVD record is dated 2024-07-19.
How to check if you're exposed
If you have shell access and WP-CLI, list the plugin and its version:
wp plugin list --name=payplus-payment-gateway --fields=name,status,version
Without WP-CLI, open the Plugins page in wp-admin and read the version shown under PayPlus Payment Gateway. Anything below 6.6.9 is affected. Remember that a deactivated plugin still sits on disk, and you should remove it if you do not use it.
For fleets, check each site rather than assuming. Agencies often run the same plugin on many stores, and one forgotten staging copy with live customer data is enough to cause trouble. The free scan at gold.safeguard.sh/scan can read a dependency manifest in the browser if you track plugins in a Composer file.
What to do now
- Update PayPlus Payment Gateway to 6.6.9 or later on every site, staging copies included.
- If you cannot update today, deactivate the plugin until you can. Taking the payment option offline is cheaper than a database incident.
- Review web server logs for unusual requests to the WooCommerce API entry point, and look for slow or oddly shaped query strings against the store front.
- Check the database for unexpected new administrator users or changed options, and rotate any credentials that could have been read from the database.
- Add the plugin to an inventory so the next advisory reaches you the same day it is published.
Why it matters
SQL injection happens when user input becomes part of a database statement without being separated from the command. The database then cannot tell where the data ends and the instructions begin. On a payment plugin the database usually holds orders, customer details and user accounts, so the impact fields in the vector are all rated High.
What makes this one worse than most is the route. It is available to unauthenticated visitors, so an attacker needs no account and no click from a victim. That removes the usual layers of friction. The durable fix is parameterised queries in the plugin code, which is what the vendor shipped in 6.6.9.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does a deactivated plugin still put me at risk?
Possibly. The code stays on disk, and some route handlers can still be reachable depending on how the plugin loads. Delete the plugin if you do not need it, and update it if you do.
Why do the record and WPScan show different scores?
The record carries a 9.8 score and WPScan shows 8.6. Scorers weigh the same details differently. The fixed version, 6.6.9, is the same in both.
Sources
- WPScan entry for CVE-2024-6205
- NVD record for CVE-2024-6205, as held in the batch record file
Last reviewed: 19 October 2026.
