# Cardinity Payment Gateway for WooCommerce <= 3.4.1 - Missing Authorization to Unauthenticated Transaction Log Download

- **ID:** WPSEC-2026-0947
- **Plugin:** Cardinity Payment Gateway for WooCommerce (`cardinity-free-payment-gateway-for-woocommerce`), https://wordpress.org/plugins/cardinity-free-payment-gateway-for-woocommerce/
- **Affected versions:** from 3.0.2 before 3.4.2
- **Fixed in:** 3.4.2 (Update to 3.4.2 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/cardinity-free-payment-gateway-for-woocommerce
- **Fix released:** 2026-10-12
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0947/

## Description

The Cardinity Payment Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data in versions 3.0.2 to 3.4.1 due to a missing capability check and nonce verification on the cardinity_wc_download_log() function, which is hooked to admin_init for AJAX requests. This makes it possible for unauthenticated attackers to download the plugin's monthly transaction logs through admin-ajax.php, which contain order IDs, payment IDs, amounts and payment statuses.

## References

- https://wpsec.com/vuln/WPSEC-2026-0947/
- https://plugins.svn.wordpress.org/cardinity-free-payment-gateway-for-woocommerce/tags/3.4.2/
- https://wordpress.org/plugins/cardinity-free-payment-gateway-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0947/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.