CVE Intelligence
Analysis AI-assisted

CVE-2026-56036: WordPress 결제 심플페이 - Unauthenticated SQL Injection

CVE-2026-56036 describes an unauthenticated SQL injection (CWE-89) affecting 워드프레스 결제 심플페이 in versions up to and including 5.5.6. The record carries a CVSS 3.1 base score of 9.3 (critical) from audit@patchstack.com, but no structured affected or fixed version list is available. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

This CVE record, published on 2026-06-26, describes an unauthenticated SQL injection in 워드프레스 결제 심플페이 in versions up to and including 5.5.6. The weakness is classified as CWE-89 (SQL Injection). The only product reference in the record points to a Patchstack database entry.

Impact

The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. It indicates network attack vector, low complexity, no privileges and no user interaction required, scope changed, high confidentiality impact, no integrity impact and low availability impact. The recorded base score is 9.3, rated critical.

In general terms, SQL injection flaws can allow an attacker to read or alter data held by the application database. The exact data exposed in this case is not described in the record.

Affected products and versions

  • The description states versions up to and including 5.5.6.
  • The record contains no structured list of affected or fixed versions.
  • The only reference URL refers to a plugin whose slug is pgall-for-woocommerce, which does not match the Korean product name in the description. The mapping between the two has not been confirmed by the sources.

Exploitation status

The record does not list this CVE in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The EPSS entry in the record gives a probability of 0.004 with a percentile of 0.32399, dated 2026-10-13. EPSS estimates likelihood of exploitation activity and is not evidence that exploitation has occurred.

Remediation and mitigation

  • Check whether 워드프레스 결제 심플페이 is installed on WordPress sites and which version is running.
  • The record provides no fixed version. Check the vendor and the Patchstack entry for an update, and apply it as soon as a fixed release is published.
  • If no fix is available, consider disabling or removing the component until a vendor response exists.
  • Restrict database account privileges to the minimum the application needs, and place web application firewall protections in front of the site as recommended by the vendor or your security team.
  • Keep WordPress core and other plugins up to date to reduce overall attack surface.

Detection guidance

  • Review web server and application logs for unusual request patterns directed at payment-related endpoints.
  • Look for database errors or unexpected query failures that may indicate malformed input reaching the database layer.
  • Monitor for unexpected changes to payment or user records and for unusual database access volumes.

Limitations of the available information

  • The NVD source status is Deferred, so analysis may be incomplete.
  • No vendor name, fixed version or detailed affected component is provided in the record.
  • The product name in the description and the plugin slug in the reference do not match.
  • No technical details beyond the classification are included, and this analysis does not add any.

Frequently asked questions

What is CVE-2026-56036?

It is a CVE record describing an unauthenticated SQL injection (CWE-89) in 워드프레스 결제 심플페이 in versions up to and including 5.5.6.

Is this vulnerability being actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Is a fixed version available?

The record does not provide a fixed version. Check the vendor and the Patchstack entry for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.