External risk intelligence

Epayco Plugin SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-78260

The vulnerability affects a payment gateway plugin for WordPress. Payment gateways are typically deployed as internet-facing components to facilitate transactions, making them commonly accessible from the public web in standard deployments.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical unauthenticated SQL injection vulnerability discovered in Epayco software. SQL injection flaws can allow unauthorized access to sensitive data by manipulating database queries. The primary concern is to confirm if Epayco software is used within the organization and, if so, to understand its potential exposure.

Unauthenticated injection allows unauthorized database access.
Matters due to payment processing implications.
Confirm Epayco usage and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted SQL queries over the network to the vulnerable payment gateway. This can occur without any prior authentication, potentially leading to unauthorized access to sensitive data or disruption of services.

No authentication required.
Send malicious SQL queries remotely.
Data exposure and service disruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject SQL commands into the Epayco plugin. When supported by the advisory, this could affect system data.

Plugin and system data.
Via crafted network requests.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated SQL injection vulnerability affects Epayco, a payment gateway plugin for WordPress. Since payment gateways are typically internet-facing, platform and security teams should prioritize identifying all instances of this plugin. Once located, confirming reachability and business criticality will inform risk-based remediation planning, potentially involving vendor coordination.

Ownership: Platform and security teams.
Verify first: Plugin presence and network exposure.
Action: Plan vendor-coordinated updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Epayco plugin?

Epayco is a payment gateway plugin designed for WordPress sites. It functions as an integration layer that connects an online store's checkout process to the Epayco payment processing infrastructure, allowing merchants to securely collect customer payments directly through their website.

What does CVE-2026-78260 mean by SQL injection?

This vulnerability, classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), means the plugin fails to properly filter input. An attacker can use this flaw to insert malicious SQL commands into the database queries normally used by the plugin, potentially causing the system to reveal restricted information.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending a specially crafted network request containing malicious SQL code directly to the plugin. Because it is an unauthenticated vulnerability, the attacker does not need a user account or special permissions to interact with the plugin. Note that simply browsing the site or performing standard administrative tasks does not trigger the bug.

Is my site at risk from CVE-2026-78260?

You should consider your risk high if you run the affected Epayco versions. According to Halo Surface Signal, payment gateway plugins are inherently designed to be internet-facing to handle incoming customer transactions, which significantly increases the likelihood that an attacker can reach this vulnerability over the public web.

How should I respond to this threat?

Your first step is to perform an inventory of your WordPress installations to confirm if the Epayco plugin is installed and running a version at or below 8.4.6. Once identified, document the business role of the affected site and coordinate with your team to apply the vendor's security update or transition to a patched version to resolve the risk.

References

patchstack.com/database/wordpress/plugin/epayco-gateway/vulnerabilit…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.