# WooCommerce Amazon Pay <= 2.6.2 - Unauthenticated Authentication Bypass via Amazon Account Linking

- **ID:** WPSEC-2026-1726
- **Plugin:** Amazon Pay for WooCommerce (`woocommerce-gateway-amazon-payments-advanced`), https://wordpress.org/plugins/woocommerce-gateway-amazon-payments-advanced/
- **Affected versions:** from 2.0.0 before 2.6.3
- **Fixed in:** 2.6.3 (Update to 2.6.3 or later.)
- **Severity:** Medium 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N)
- **Weakness:** CWE-287
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woocommerce-gateway-amazon-payments-advanced
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1726/

## Description

The Amazon Pay for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via the Amazon account linking mechanism in all versions from 2.0.0 up to, and including, 2.6.2. This is due to two things. First, the 'amazon_login' return handler stores any 'amazonCheckoutSessionId' from the URL in the visitor's session without checking that the visitor started that checkout session. Second, linking an Amazon buyer ID to the logged-in shop account needed no password confirmation, the link option was checked by default, and the link was saved before payment. This makes it possible for unauthenticated attackers to plant their own Amazon checkout session in a logged-in customer's session through a crafted link. If that customer then places an order, the attacker's Amazon account is linked to the customer's account, and the attacker can later sign in as that customer with Amazon.

## References

- https://wpsec.com/vuln/WPSEC-2026-1726/
- https://plugins.svn.wordpress.org/woocommerce-gateway-amazon-payments-advanced/tags/2.6.3/
- https://wordpress.org/plugins/woocommerce-gateway-amazon-payments-advanced/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1726/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.