{
 "id": "WPSEC-2026-1317",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1317/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1317/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1317/index.md",
 "title": "Mintpay <= 2.2.3 - Missing Authorization to Unauthenticated Arbitrary Order Cancellation and Order Data Exposure",
 "description": "The mintpay plugin for WordPress is vulnerable to unauthorized modification and exposure of data in all versions up to, and including, 2.2.3. This is due to a missing authorization check in the payment return callback (the check_mintpay_response() function, reached through the 'Mintpay_Gateway' wc-api endpoint and hooked to init). The callback loads any order from the user-supplied 'orderId' parameter. When the supplied 'hash' fails validation, it still sets that order to cancelled, whatever its payment method or status, and then redirects to the order's payment URL, which contains the order key. This makes it possible for unauthenticated attackers to cancel arbitrary WooCommerce orders by enumerating order IDs, and to obtain order keys that may expose customers' order details.",
 "plugin": {
  "slug": "mintpay",
  "name": "Mintpay",
  "full_name": "Mintpay",
  "wordpress_org": "https://wordpress.org/plugins/mintpay/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mintpay/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mintpay"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.0.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.0.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.0.0",
 "remediation": "Update to 3.0.0 or later.",
 "fix_released": "2026-10-20T09:10:00+00:00",
 "published": "2026-10-21T10:43:36+00:00",
 "updated": "2026-10-21T10:36:09.282279+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1317/",
  "https://plugins.svn.wordpress.org/mintpay/tags/3.0.0/",
  "https://wordpress.org/plugins/mintpay/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mintpay",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-21"
 }
}