GlobalPayments WooCommerce <= 1.23.2 - Unauthenticated Arbitrary Order Status Update via Blik and Bank Select Callbacks
- ID
- WPSEC-2026-1515
- Plugin
- GlobalPayments Gateway Provider for WooCommerce (global-payments-woocommerce)
- Affected
- from 1.14.0 before 1.23.3
- Remediation
- Update to 1.23.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-23
- Attack surface
- GlobalPayments WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The GlobalPayments Gateway Provider for WooCommerce plugin for WordPress is vulnerable to an authentication bypass via the Blik and Bank Select (DiUi APM) status notification and redirect callback handlers in all versions from 1.14.0 up to, and including, 1.23.2. This is due to the handlers not requiring the transaction id of a signed callback to match the transaction id stored on the order the callback names. This makes it possible for unauthenticated attackers who hold any validly signed callback, such as one from their own guest order, to change the status of other customers' on-hold or pending orders to failed or cancelled.
References
- https://wpsec.com/vuln/WPSEC-2026-1515/
- https://plugins.svn.wordpress.org/global-payments-woocommerce/tags/1.23.3/
- https://wordpress.org/plugins/global-payments-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS