The Paymob for WooCommerce plugin versions prior to 4.1.9 contain a SQL injection vulnerability (CWE-89) due to improper sanitization of a client-supplied identifier in an unauthenticated payment callback endpoint. The plugin executes a SQL query using this unsanitized input before verifying the payment provider's HMAC signature, enabling attackers to inject SQL commands. This flaw allows attackers to extract arbitrary data from the database, including sensitive user credentials and secrets, through reflected and time-based blind SQL injection methods. No CVSS score or official patch information is currently available.

An unauthenticated attacker can exploit this vulnerability to perform SQL injection attacks against the plugin's database. This can lead to unauthorized disclosure of sensitive data such as user credentials and other secrets stored in the database. The vulnerability affects the confidentiality of the system's data and could potentially facilitate further attacks depending on the data accessed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. Due to the lack of an official patch or mitigation guidance, no specific remediation steps can be recommended at this time.