CVE-2026-8705 ClearSale Total WordPress Plugin SQL Injection Vulnerability

Technical summary

CVE-2026-8705 is a SQL injection vulnerability in the ClearSale Total WordPress plugin affecting versions up to 3.4.2. The vulnerability is present in the `clearsale_total_push` AJAX action handler, which is registered to process requests from unauthenticated users via `wp_ajax_nopriv_clearsale_total_push`. The handler accepts the `pagseguro[metodo]` POST parameter but fails to properly sanitize it before incorporation into a SQL UPDATE statement targeting the `wp_cs_total_dadosextras` table. Although `wp_verify_nonce()` is called, the failing branch contains only a commented-out `die()` statement, allowing execution to continue even when the nonce check fails. On PHP < 8.0, loose type comparison allows the string value "4 AND SLEEP(5)" to match the integer case 4 in a switch statement, bypassing the intended input restriction. The attacker-controlled `$metodo` value is then passed unquoted into an UPDATE query, enabling arbitrary SQL injection and information disclosure. The vulnerability requires PHP < 8.0 to exploit successfully, as PHP 8.0+ enforces stricter type comparisons in switch statements.

Business impact

A successful exploitation of this vulnerability allows attackers to read sensitive data from the WordPress database without authentication, including customer information, payment details, order history, and any other data stored by the ClearSale plugin and associated WordPress installation. For e-commerce sites using this payment processing plugin, this represents a significant data breach risk that could expose customer personally identifiable information and payment-related records. The reputational damage from a database compromise, combined with potential regulatory fines under GDPR, CCPA, and similar regulations, makes this a critical business concern. The attack requires no user interaction and can be performed at scale across multiple sites running the vulnerable plugin.

Affected systems

The ClearSale Total WordPress plugin in all versions up to and including 3.4.2 is affected. The vulnerability is exploitable only on web servers running PHP versions earlier than 8.0 (PHP 5.x through 7.x). WordPress installations with this plugin active on PHP < 8.0 are at risk. The attack surface is wide because the vulnerable endpoint is accessible to unauthenticated users without requiring a valid WordPress account or login credentials.

Exploitability

This vulnerability is highly exploitable in terms of ease and accessibility. The attack requires only HTTP POST requests to a publicly accessible AJAX endpoint, with no authentication required and no user interaction needed. An attacker can craft a malicious POST request with a specially crafted `pagseguro[metodo]` parameter that includes SQL injection syntax. The loose type juggling on PHP < 8.0 simplifies the bypass technique, allowing straightforward string values to pass the integer switch statement check. The vulnerability can be detected and exploited with basic web scraping and database query knowledge, making it attractive to both opportunistic attackers and threat actors seeking to harvest customer data. However, exploitation is limited to environments running PHP 7.x or earlier; sites on PHP 8.0 and newer are not vulnerable due to stricter type enforcement.

Remediation

The primary remediation is to update the ClearSale Total plugin to a patched version that fixes the SQL injection and nonce validation issues. Verify the latest available version against the official WordPress plugin repository or the vendor's website to confirm the vulnerability has been addressed. Additionally, ensure your WordPress installation is running on PHP 8.0 or newer, which provides an additional layer of protection by preventing the type juggling bypass used in this exploit. As an interim mitigation, disable the ClearSale Total plugin if it cannot be immediately updated, or restrict access to the AJAX endpoint via web application firewall rules that block requests with SQL syntax characters in the `pagseguro[metodo]` parameter.

Patch guidance

Check the official ClearSale Total plugin page on the WordPress.org repository for the latest available version. Download and install updates through the WordPress admin dashboard's plugin update interface, or manually upload the patched version to ensure you are running a version released after the publication date of this vulnerability. Verify that the installed version is newer than 3.4.2 and review the plugin's changelog to confirm the SQL injection and nonce validation issues are explicitly documented as fixed. After updating, conduct a database audit to identify any suspicious activity or unauthorized queries that may have occurred while the site was vulnerable.

Detection guidance

Monitor web server logs and AJAX request logs for POST requests to `/wp-admin/admin-ajax.php?action=clearsale_total_push` from external IP addresses or unusual sources. Look for POST parameters containing SQL keywords such as UNION, SELECT, INSERT, UPDATE, DELETE, OR, AND, SLEEP, BENCHMARK, or other SQL syntax in the `pagseguro[metodo]` parameter. Set up Web Application Firewall (WAF) rules to alert on or block HTTP requests to this endpoint containing metacharacters common in SQL injection attacks (semicolons, quotes, dashes, parentheses in parameter values). Additionally, query database logs for unexpected UPDATE statements against the `wp_cs_total_dadosextras` table that originate from application-level connections rather than administrative users. Monitor for unusual database query patterns or slow queries that might indicate SLEEP() or time-delay injection techniques being used for data exfiltration.

Why prioritize this

This vulnerability warrants immediate patching due to its HIGH CVSS score (7.5), combination of high impact (confidentiality) with low attack complexity, and zero authentication requirement. The vulnerability affects a plugin used in e-commerce contexts where database breach has severe financial and regulatory consequences. The limitation to PHP < 8.0 does provide some natural mitigation for organizations running modern PHP versions, but many WordPress sites still operate on PHP 7.x, keeping the threat surface substantial. The ease of exploitation and the sensitivity of data at risk (customer records, payment information) make this a top priority for any organization using the ClearSale Total plugin.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a vulnerability that is network-accessible with no authentication or user interaction required, exploitable with low complexity, and results in high confidentiality impact (unauthorized database read access). However, the integrity and availability of the system remain unaffected by this specific vulnerability. The requirement for PHP < 8.0 slightly reduces the effective risk for organizations running modern PHP versions, but the prevalence of PHP 7.x in production WordPress environments keeps the overall risk assessment high. The 7.5 score appropriately weights this as a critical priority for affected organizations.

Frequently asked questions