# Pay With MetaMask For WooCommerce <= 1.7.2 - Unauthenticated Payment Verification Bypass via Forged ERC-20 Token Transfer

- **ID:** WPSEC-2026-0747
- **Plugin:** Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway (`cryptocurrency-payments-using-metamask-for-woocommerce`), https://wordpress.org/plugins/cryptocurrency-payments-using-metamask-for-woocommerce/
- **Affected versions:** all versions before 1.7.3
- **Fixed in:** 1.7.3 (Update to 1.7.3 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/cryptocurrency-payments-using-metamask-for-woocommerce
- **Fix released:** 2026-10-08
- **Published:** 2026-10-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0747/

## Description

The Pay With MetaMask For WooCommerce plugin for WordPress is vulnerable to payment verification bypass via the transaction verification REST endpoint in all versions up to, and including, 1.7.2. This is due to insufficient verification of on-chain transaction data. When any transaction carried calldata in the form of an ERC-20 transfer(address,uint256) call, the plugin read the recipient and amount from that calldata and accepted the payment. It did not check that the transaction was sent to the order's token contract, that a matching Transfer event was emitted, or that the order was meant to be paid in a token at all. This makes it possible for unauthenticated attackers (customers using guest checkout) to mark their own WooCommerce orders as paid without paying. They only need to submit a successful zero-value transaction that carries crafted transfer calldata naming the merchant wallet and the order amount, sent to an address or contract they control.

## References

- https://wpsec.com/vuln/WPSEC-2026-0747/
- https://plugins.svn.wordpress.org/cryptocurrency-payments-using-metamask-for-woocommerce/tags/1.7.3/
- https://wordpress.org/plugins/cryptocurrency-payments-using-metamask-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0747/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.