# Casso – Tự động xác nhận thanh toán chuyển khoản ngân hàng <= 4.1.1 - Unauthenticated Authentication Bypass to Order Payment Confirmation via Webhook

- **ID:** WPSEC-2026-1244
- **Plugin:** Casso Flow – Tự động xác nhận thanh toán chuyển khoản ngân hàng (`casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang`), https://wordpress.org/plugins/casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/
- **Affected versions:** all versions before 4.2.0
- **Fixed in:** 4.2.0 (Update to 4.2.0 or later.)
- **Severity:** Medium 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
- **Weakness:** CWE-287
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-19)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang
- **Fix released:** 2026-10-18
- **Published:** 2026-10-19
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1244/

## Description

The Casso Flow plugin for WordPress is vulnerable to authentication bypass in the bank transfer webhook handler in all versions up to, and including, 4.1.1 due to the secure token check accepting an empty token when no secure token has been configured. This makes it possible for unauthenticated attackers to send forged webhook requests that mark orders as paid, on sites where the webhook secure token is empty (for example fresh or misconfigured installations).

## References

- https://wpsec.com/vuln/WPSEC-2026-1244/
- https://plugins.svn.wordpress.org/casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/tags/4.2.0/
- https://wordpress.org/plugins/casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1244/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.