Autopay <= 5.0.5 - Unauthenticated Order Status Manipulation via Forged ITN Payment Notification
- ID
- WPSEC-2026-1766
- Plugin
- Autopay (platnosci-online-blue-media)
- Affected
- all versions before 5.1.0
- Remediation
- Update to 5.1.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-27
- Attack surface
- Autopay on WPSec AttackSurface
- Fix released
- Published
Description
The Autopay plugin for WordPress is vulnerable to order payment status manipulation via the ITN payment notification webhook (wc-api=wc_gateway_bluemedia) in all versions up to, and including, 5.0.5. This is due to insufficient verification of data authenticity: the handler stored the remote payment status for the order ID in the notification before it checked the notification hash, and it did not restrict the status to known values. This makes it possible for unauthenticated attackers to send forged payment notifications that overwrite the stored remote payment status (for example with SUCCESS) of any order awaiting an Autopay payment. Genuine notifications for that order are then treated as already processed, so a paid order may never be marked as paid.
References
- https://wpsec.com/vuln/WPSEC-2026-1766/
- https://plugins.svn.wordpress.org/platnosci-online-blue-media/tags/5.1.0/
- https://wordpress.org/plugins/platnosci-online-blue-media/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS