# Casso – Tự động xác nhận thanh toán chuyển khoản ngân hàng <= 4.1.1 - Missing Authorization to Casso Account Relinking via OAuth2 Callback

- **ID:** WPSEC-2026-1246
- **Plugin:** Casso Flow – Tự động xác nhận thanh toán chuyển khoản ngân hàng (`casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang`), https://wordpress.org/plugins/casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/
- **Affected versions:** all versions before 4.2.0
- **Fixed in:** 4.2.0 (Update to 4.2.0 or later.)
- **Severity:** High 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-19)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang
- **Fix released:** 2026-10-18
- **Published:** 2026-10-19
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1246/

## Description

The Casso Flow plugin for WordPress is vulnerable to unauthorized modification of data via the public WooCommerce API OAuth2 callback (wc-api=oauth2-callback) in all versions up to, and including, 4.1.1, due to a missing capability check and missing state/nonce validation in the casso_oauth2_handler() function. The handler takes an authorization code from the request, stores the resulting OAuth tokens, deletes and re-creates the payment webhook and replaces the shop's stored bank accounts. This makes it possible for unauthenticated attackers to relink a shop to their own Casso business, which puts the attacker's bank accounts on the checkout page and redirects customer transfers to them. Even an invalid code wipes the shop's stored bank accounts, which disrupts payment confirmation.

## References

- https://wpsec.com/vuln/WPSEC-2026-1246/
- https://plugins.svn.wordpress.org/casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/tags/4.2.0/
- https://wordpress.org/plugins/casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1246/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.