PT-2026-1574 · WordPress+1 · Hitpay Payment Gateway For Woocommerce+1
Teerachai Somprasong
·
Publicado
2026-01-07
·
Atualizado
2026-01-07
·
CVE-2026-0656
CVSS v3.1
8.2
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
iPaymu Payment Gateway for WooCommerce plugin for WordPress versions up to and including 2.0.2
Description
The iPaymu Payment Gateway for WooCommerce plugin for WordPress is susceptible to missing authentication. This occurs because the plugin does not validate the authenticity of webhook requests through signature verification or origin checks. An unauthenticated attacker can send crafted POST requests to the webhook endpoint to falsely mark WooCommerce orders as paid, without actual payment. Additionally, attackers can enumerate order IDs and obtain valid order keys via GET requests, potentially exposing customer Personally Identifiable Information (PII) such as names, addresses, and purchased products. The vulnerable function is
check ipaymu response.Recommendations
Update the iPaymu Payment Gateway for WooCommerce plugin for WordPress to a version later than 2.0.2.
Correção
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Woocommerce
Hitpay Payment Gateway For Woocommerce