{
 "id": "WPSEC-2026-1726",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1726/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1726/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1726/index.md",
 "title": "WooCommerce Amazon Pay <= 2.6.2 - Unauthenticated Authentication Bypass via Amazon Account Linking",
 "description": "The Amazon Pay for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via the Amazon account linking mechanism in all versions from 2.0.0 up to, and including, 2.6.2. This is due to two things. First, the 'amazon_login' return handler stores any 'amazonCheckoutSessionId' from the URL in the visitor's session without checking that the visitor started that checkout session. Second, linking an Amazon buyer ID to the logged-in shop account needed no password confirmation, the link option was checked by default, and the link was saved before payment. This makes it possible for unauthenticated attackers to plant their own Amazon checkout session in a logged-in customer's session through a crafted link. If that customer then places an order, the attacker's Amazon account is linked to the customer's account, and the attacker can later sign in as that customer with Amazon.",
 "plugin": {
  "slug": "woocommerce-gateway-amazon-payments-advanced",
  "name": "WooCommerce Amazon Pay",
  "full_name": "Amazon Pay for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/woocommerce-gateway-amazon-payments-advanced/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woocommerce-gateway-amazon-payments-advanced/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woocommerce-gateway-amazon-payments-advanced"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-287"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.8,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.0.0",
    "from_inclusive": true,
    "to": "2.6.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.0.0 before 2.6.3"
  ]
 },
 "introduced_in": "2.0.0",
 "fixed_in": "2.6.3",
 "remediation": "Update to 2.6.3 or later.",
 "fix_released": "2026-10-26T11:01:44+00:00",
 "published": "2026-10-27T11:50:51+00:00",
 "updated": "2026-10-26T13:21:24.860146+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1726/",
  "https://plugins.svn.wordpress.org/woocommerce-gateway-amazon-payments-advanced/tags/2.6.3/",
  "https://wordpress.org/plugins/woocommerce-gateway-amazon-payments-advanced/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woocommerce-gateway-amazon-payments-advanced",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-27"
 }
}