The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress suffers from a time-based blind SQL Injection vulnerability (CWE-89) in the 'MerchantReference' parameter. This occurs because user input is not properly escaped or prepared before being included in SQL queries, allowing unauthenticated attackers to inject additional SQL commands. The vulnerability affects all plugin versions up to and including 1.6.5.1. Exploitation can lead to unauthorized extraction of sensitive data from the backend database. The CVSS v3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available to confirm remediation status.

Successful exploitation of this vulnerability allows unauthenticated attackers to perform time-based blind SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive information, modification of data, or disruption of service. The high CVSS score (9.8) indicates critical impact on confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported, but the vulnerability poses a significant risk if left unmitigated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the affected plugin or restricting access to the vulnerable parameter if possible. Monitor official channels from the vendor enartia for updates and apply patches promptly once available.