Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-8705 – Unauthenticated SQL Injection – ClearSale Total WordPress Plugin ≤ 3.4.2

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-8705 is a high-severity SQL Injection vulnerability affecting the ClearSale Total plugin for WordPress (versions ≤ 3.4.2), a WooCommerce anti-fraud and payment integration plugin. Unauthenticated remote attackers can inject arbitrary SQL into an unprotected AJAX endpoint, enabling full read access to the underlying WordPress database. The vulnerability carries a CVSS v3.1 base score of 7.5 (HIGH) and requires no privileges or user interaction to exploit.

Technical details

  • Root cause: Three compounding weaknesses enable exploitation. First, the clearsale_total_push AJAX handler is registered under wp_ajax_nopriv_clearsale_total_push, making it reachable without authentication. Second, while a wp_verify_nonce() check exists in the handler, the die() call in the nonce-failure branch has been commented out, so execution continues unconditionally regardless of nonce validity — effectively neutralising the intended access control. Third, the pagseguro[metodo] POST parameter is written directly into an unquoted SQL UPDATE statement (UPDATE wp_cs_total_dadosextras SET metodo=$metodo, ...) with no escaping or parameterisation.
  • Trigger condition: On PHP versions below 8.0, PHP’s loose type comparison allows an attacker to supply a crafted string such as "4 AND SLEEP(5)", which the switch ($metodo) { case 4: ... } guard evaluates as equal to integer 4 due to type juggling. This lands execution inside the vulnerable code path and inserts the attacker-supplied string directly into the SQL query. PHP 8.0 and above deprecated this loose comparison behaviour, which breaks this specific bypass.
  • Attack vector: Unauthenticated HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php?action=clearsale_total_push), reachable from the internet with no prior access.
  • Impact: Unauthenticated attackers can append arbitrary SQL to existing queries and extract sensitive data from the WordPress database, including user credentials, order records, and payment-related information stored by WooCommerce. Integrity and availability are not directly impacted per the CVSS assessment.

Affected software

  • ClearSale Total plugin for WordPress — all versions up to and including 3.4.2
  • Exploitation additionally requires the host to be running PHP < 8.0

Severity

  • CVSS v3.1 Base Score: 7.5 (HIGH)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Mitigation and recommended actions

  • No patch is currently available. The ClearSale Total plugin was closed on the WordPress.org Plugin Repository on June 21, 2026, pending a full security review. No fixed version has been released as of the publication of this advisory.
  • Immediate action — deactivate and remove the plugin: Site administrators running the ClearSale Total plugin should deactivate and uninstall it immediately until a patched version is made available by the vendor.
  • Partial server-side mitigation: Upgrading the server’s PHP runtime to PHP 8.0 or higher removes the loose type juggling condition that enables the SQL injection bypass. However, this does not fix the underlying nonce bypass or the unquoted SQL parameter; it solely prevents the currently known exploitation path. Removing the plugin remains the recommended action.
  • Network mitigation: If immediate removal is not possible, restrict access to /wp-admin/admin-ajax.php at the WAF or network layer to block unauthenticated external requests while a full remediation is planned.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge