Vulnerabilities / Casso – Tự động xác nhận thanh toán chuyển khoản ngân hàng / WPSEC-2026-1244
Casso – Tự động xác nhận thanh toán chuyển khoản ngân hàng <= 4.1.1 - Unauthenticated Authentication Bypass to Order Payment Confirmation via Webhook
Medium 5.9
CWE-287Fixed in 4.2.0
- ID
- WPSEC-2026-1244
- Plugin
- Casso Flow – Tự động xác nhận thanh toán chuyển khoản ngân hàng (casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang)
- Affected
- all versions before 4.2.0
- Remediation
- Update to 4.2.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weakness
- CWE-287
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-19
- Attack surface
- Casso – Tự động xác nhận thanh toán chuyển khoản ngân hàng on WPSec AttackSurface
- Fix released
- Published
Description
The Casso Flow plugin for WordPress is vulnerable to authentication bypass in the bank transfer webhook handler in all versions up to, and including, 4.1.1 due to the secure token check accepting an empty token when no secure token has been configured. This makes it possible for unauthenticated attackers to send forged webhook requests that mark orders as paid, on sites where the webhook secure token is empty (for example fresh or misconfigured installations).
References
- https://wpsec.com/vuln/WPSEC-2026-1244/
- https://plugins.svn.wordpress.org/casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/tags/4.2.0/
- https://wordpress.org/plugins/casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS