Mintpay <= 2.2.3 - Missing Authorization to Unauthenticated Arbitrary Order Cancellation and Order Data Exposure
- ID
- WPSEC-2026-1317
- Plugin
- Mintpay (mintpay)
- Affected
- all versions before 3.0.0
- Remediation
- Update to 3.0.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-21
- Attack surface
- Mintpay on WPSec AttackSurface
- Fix released
- Published
Description
The mintpay plugin for WordPress is vulnerable to unauthorized modification and exposure of data in all versions up to, and including, 2.2.3. This is due to a missing authorization check in the payment return callback (the check_mintpay_response() function, reached through the 'Mintpay_Gateway' wc-api endpoint and hooked to init). The callback loads any order from the user-supplied 'orderId' parameter. When the supplied 'hash' fails validation, it still sets that order to cancelled, whatever its payment method or status, and then redirects to the order's payment URL, which contains the order key. This makes it possible for unauthenticated attackers to cancel arbitrary WooCommerce orders by enumerating order IDs, and to obtain order keys that may expose customers' order details.
References
- https://wpsec.com/vuln/WPSEC-2026-1317/
- https://plugins.svn.wordpress.org/mintpay/tags/3.0.0/
- https://wordpress.org/plugins/mintpay/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS