WooCommerce Amazon Pay <= 2.6.2 - Unauthenticated Authentication Bypass via Amazon Account Linking
- ID
- WPSEC-2026-1726
- Plugin
- Amazon Pay for WooCommerce (woocommerce-gateway-amazon-payments-advanced)
- Affected
- from 2.0.0 before 2.6.3
- Remediation
- Update to 2.6.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- Weakness
- CWE-287
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-27
- Attack surface
- WooCommerce Amazon Pay on WPSec AttackSurface
- Fix released
- Published
Description
The Amazon Pay for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via the Amazon account linking mechanism in all versions from 2.0.0 up to, and including, 2.6.2. This is due to two things. First, the 'amazon_login' return handler stores any 'amazonCheckoutSessionId' from the URL in the visitor's session without checking that the visitor started that checkout session. Second, linking an Amazon buyer ID to the logged-in shop account needed no password confirmation, the link option was checked by default, and the link was saved before payment. This makes it possible for unauthenticated attackers to plant their own Amazon checkout session in a logged-in customer's session through a crafted link. If that customer then places an order, the attacker's Amazon account is linked to the customer's account, and the attacker can later sign in as that customer with Amazon.
References
- https://wpsec.com/vuln/WPSEC-2026-1726/
- https://plugins.svn.wordpress.org/woocommerce-gateway-amazon-payments-advanced/tags/2.6.3/
- https://wordpress.org/plugins/woocommerce-gateway-amazon-payments-advanced/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS