# Mintpay <= 2.2.3 - Missing Authorization to Unauthenticated Arbitrary Order Cancellation and Order Data Exposure

- **ID:** WPSEC-2026-1317
- **Plugin:** Mintpay (`mintpay`), https://wordpress.org/plugins/mintpay/
- **Affected versions:** all versions before 3.0.0
- **Fixed in:** 3.0.0 (Update to 3.0.0 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/mintpay
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1317/

## Description

The mintpay plugin for WordPress is vulnerable to unauthorized modification and exposure of data in all versions up to, and including, 2.2.3. This is due to a missing authorization check in the payment return callback (the check_mintpay_response() function, reached through the 'Mintpay_Gateway' wc-api endpoint and hooked to init). The callback loads any order from the user-supplied 'orderId' parameter. When the supplied 'hash' fails validation, it still sets that order to cancelled, whatever its payment method or status, and then redirects to the order's payment URL, which contains the order key. This makes it possible for unauthenticated attackers to cancel arbitrary WooCommerce orders by enumerating order IDs, and to obtain order keys that may expose customers' order details.

## References

- https://wpsec.com/vuln/WPSEC-2026-1317/
- https://plugins.svn.wordpress.org/mintpay/tags/3.0.0/
- https://wordpress.org/plugins/mintpay/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1317/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.