PT-2026-8048 · WordPress+1 · Bluesnap Payment Gateway For Woocommerce+1

Harmz

·

Publicado

2026-02-14

·

Atualizado

2026-02-14

·

CVE-2026-0692

CVSS v3.1

7.5

Alta

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions BlueSnap Payment Gateway for WooCommerce plugin for WordPress versions up to and including 3.3.0
Description The BlueSnap Payment Gateway for WooCommerce plugin for WordPress is susceptible to unauthorized access. The plugin uses the WooCommerce WC Geolocation::get ip address() function to validate IPN requests, which relies on user-controlled headers such as X-Real-IP and X-Forwarded-For to determine the client IP address. This allows attackers to bypass IP allowlist restrictions by spoofing a whitelisted BlueSnap IP address and sending forged IPN data. This manipulation can alter order statuses, including marking orders as paid, failed, refunded, or on-hold, without authorization.
Recommendations Update the BlueSnap Payment Gateway for WooCommerce plugin to a version later than 3.3.0.

Correção

Missing Authorization

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-0692

Produtos afetados

Bluesnap Payment Gateway For Woocommerce
Woocommerce