{
 "id": "WPSEC-2026-1766",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1766/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1766/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1766/index.md",
 "title": "Autopay <= 5.0.5 - Unauthenticated Order Status Manipulation via Forged ITN Payment Notification",
 "description": "The Autopay plugin for WordPress is vulnerable to order payment status manipulation via the ITN payment notification webhook (wc-api=wc_gateway_bluemedia) in all versions up to, and including, 5.0.5. This is due to insufficient verification of data authenticity: the handler stored the remote payment status for the order ID in the notification before it checked the notification hash, and it did not restrict the status to known values. This makes it possible for unauthenticated attackers to send forged payment notifications that overwrite the stored remote payment status (for example with SUCCESS) of any order awaiting an Autopay payment. Genuine notifications for that order are then treated as already processed, so a paid order may never be marked as paid.",
 "plugin": {
  "slug": "platnosci-online-blue-media",
  "name": "Autopay",
  "full_name": "Autopay",
  "wordpress_org": "https://wordpress.org/plugins/platnosci-online-blue-media/",
  "advisories_url": "https://wpsec.com/vuln/plugin/platnosci-online-blue-media/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/platnosci-online-blue-media"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.1.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.1.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.1.0",
 "remediation": "Update to 5.1.0 or later.",
 "fix_released": "2026-10-26T14:42:22+00:00",
 "published": "2026-10-27T14:45:37+00:00",
 "updated": "2026-10-27T13:05:23.648410+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1766/",
  "https://plugins.svn.wordpress.org/platnosci-online-blue-media/tags/5.1.0/",
  "https://wordpress.org/plugins/platnosci-online-blue-media/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/platnosci-online-blue-media",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-27"
 }
}