Casso – Tự động xác nhận thanh toán chuyển khoản ngân hàng <= 4.1.1 - Missing Authorization to Casso Account Relinking via OAuth2 Callback
- ID
- WPSEC-2026-1246
- Plugin
- Casso Flow – Tự động xác nhận thanh toán chuyển khoản ngân hàng (casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang)
- Affected
- all versions before 4.2.0
- Remediation
- Update to 4.2.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-19
- Attack surface
- Casso – Tự động xác nhận thanh toán chuyển khoản ngân hàng on WPSec AttackSurface
- Fix released
- Published
Description
The Casso Flow plugin for WordPress is vulnerable to unauthorized modification of data via the public WooCommerce API OAuth2 callback (wc-api=oauth2-callback) in all versions up to, and including, 4.1.1, due to a missing capability check and missing state/nonce validation in the casso_oauth2_handler() function. The handler takes an authorization code from the request, stores the resulting OAuth tokens, deletes and re-creates the payment webhook and replaces the shop's stored bank accounts. This makes it possible for unauthenticated attackers to relink a shop to their own Casso business, which puts the attacker's bank accounts on the checkout page and redirects customer transfers to them. Even an invalid code wipes the shop's stored bank accounts, which disrupts payment confirmation.
References
- https://wpsec.com/vuln/WPSEC-2026-1246/
- https://plugins.svn.wordpress.org/casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/tags/4.2.0/
- https://wordpress.org/plugins/casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS