CVE-2020-14092: WordPress Payment Form for PayPal Pro plugin SQL injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction required and a very high EPSS score make this a high-impact, remotely exploitable SQL injection.

What it is

The CodePeople Payment Form for PayPal Pro plugin for WordPress before version 1.1.65 is vulnerable to SQL injection. The flaw is remotely reachable without authentication, so any exposed installation running an older version can be attacked directly.

Impact

An attacker can inject arbitrary SQL into the plugin's database queries, potentially reading, altering or deleting data and, depending on database privileges, executing further database-level actions.

Attack surface

Reached over the network via the WordPress plugin's request handling; the CVSS vector indicates no privileges and no user interaction are required. The description does not identify the specific vulnerable parameter or endpoint.

Exploitation

Not listed in CISA KEV and no public exploit reference is tagged in the record, but EPSS is very high (0.9453, 99.8th percentile), indicating elevated likelihood of attempted exploitation.

What to do

• Update the Payment Form for PayPal Pro plugin to version 1.1.65 or later.
• If patching is not immediately possible, disable or remove the plugin until it can be updated.
• Restrict access to the WordPress admin and plugin endpoints via WAF or IP allowlisting where feasible.
• Review database accounts used by WordPress for least privilege to limit the impact of successful injection.
• Audit the site for signs of prior compromise, including unexpected database changes or admin accounts.

Detection

• Monitor web server and WAF logs for SQL metacharacters or injection patterns in requests to the plugin's endpoints.
• Alert on unexpected database errors or anomalous query behavior originating from the web application.
• Review database and file integrity for unauthorized changes on hosts running the plugin.
• Check installed plugin versions against 1.1.65 to identify exposed instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.