The payamito sms woocommerce plugin for WordPress suffers from a time-based blind SQL Injection vulnerability in the 'columns' parameter in all versions up to 1.3.5. The root cause is improper neutralization of special elements in SQL commands (CWE-89), specifically insufficient escaping of user-supplied input and lack of prepared statements. This allows unauthenticated attackers to append additional SQL queries to existing ones, potentially extracting sensitive database information. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Successful exploitation can lead to unauthorized disclosure of sensitive database information without requiring authentication. The vulnerability does not impact integrity or availability according to the CVSS vector. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Avoid exposing the vulnerable parameter to untrusted users. Monitor vendor channels for updates or patches addressing this vulnerability.