# GlobalPayments WooCommerce <= 1.23.2 - Unauthenticated Arbitrary Order Status Update via Blik and Bank Select Callbacks

- **ID:** WPSEC-2026-1515
- **Plugin:** GlobalPayments Gateway Provider for WooCommerce (`global-payments-woocommerce`), https://wordpress.org/plugins/global-payments-woocommerce/
- **Affected versions:** from 1.14.0 before 1.23.3
- **Fixed in:** 1.23.3 (Update to 1.23.3 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/global-payments-woocommerce
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1515/

## Description

The GlobalPayments Gateway Provider for WooCommerce plugin for WordPress is vulnerable to an authentication bypass via the Blik and Bank Select (DiUi APM) status notification and redirect callback handlers in all versions from 1.14.0 up to, and including, 1.23.2. This is due to the handlers not requiring the transaction id of a signed callback to match the transaction id stored on the order the callback names. This makes it possible for unauthenticated attackers who hold any validly signed callback, such as one from their own guest order, to change the status of other customers' on-hold or pending orders to failed or cancelled.

## References

- https://wpsec.com/vuln/WPSEC-2026-1515/
- https://plugins.svn.wordpress.org/global-payments-woocommerce/tags/1.23.3/
- https://wordpress.org/plugins/global-payments-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1515/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.