{
 "id": "WPSEC-2026-1515",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1515/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1515/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1515/index.md",
 "title": "GlobalPayments WooCommerce <= 1.23.2 - Unauthenticated Arbitrary Order Status Update via Blik and Bank Select Callbacks",
 "description": "The GlobalPayments Gateway Provider for WooCommerce plugin for WordPress is vulnerable to an authentication bypass via the Blik and Bank Select (DiUi APM) status notification and redirect callback handlers in all versions from 1.14.0 up to, and including, 1.23.2. This is due to the handlers not requiring the transaction id of a signed callback to match the transaction id stored on the order the callback names. This makes it possible for unauthenticated attackers who hold any validly signed callback, such as one from their own guest order, to change the status of other customers' on-hold or pending orders to failed or cancelled.",
 "plugin": {
  "slug": "global-payments-woocommerce",
  "name": "GlobalPayments WooCommerce",
  "full_name": "GlobalPayments Gateway Provider for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/global-payments-woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/global-payments-woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/global-payments-woocommerce"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.14.0",
    "from_inclusive": true,
    "to": "1.23.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.14.0 before 1.23.3"
  ]
 },
 "introduced_in": "1.14.0",
 "fixed_in": "1.23.3",
 "remediation": "Update to 1.23.3 or later.",
 "fix_released": "2026-10-22T12:09:25+00:00",
 "published": "2026-10-23T12:43:24+00:00",
 "updated": "2026-10-23T09:48:46.036487+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1515/",
  "https://plugins.svn.wordpress.org/global-payments-woocommerce/tags/1.23.3/",
  "https://wordpress.org/plugins/global-payments-woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/global-payments-woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-23"
 }
}