CVE-2026-1370 is a time-based SQL Injection vulnerability in the SIBS woocommerce payment gateway WordPress plugin affecting all versions up to 2.2.0. The issue stems from improper neutralization of special elements in the 'referencedId' parameter, allowing authenticated administrators to append malicious SQL queries due to insufficient input escaping and lack of query preparation. This can lead to unauthorized disclosure of sensitive database information. The vulnerability has a CVSS 3.1 base score of 4.9, indicating medium severity. No patch or remediation details are currently provided by the vendor.

An attacker with Administrator-level access can exploit this vulnerability to perform time-based SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not affect confidentiality, integrity, or availability beyond information disclosure. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to the 'referencedId' parameter. Avoid using affected versions of the plugin in sensitive environments if possible.