# Autopay <= 5.0.5 - Unauthenticated Order Status Manipulation via Forged ITN Payment Notification

- **ID:** WPSEC-2026-1766
- **Plugin:** Autopay (`platnosci-online-blue-media`), https://wordpress.org/plugins/platnosci-online-blue-media/
- **Affected versions:** all versions before 5.1.0
- **Fixed in:** 5.1.0 (Update to 5.1.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/platnosci-online-blue-media
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1766/

## Description

The Autopay plugin for WordPress is vulnerable to order payment status manipulation via the ITN payment notification webhook (wc-api=wc_gateway_bluemedia) in all versions up to, and including, 5.0.5. This is due to insufficient verification of data authenticity: the handler stored the remote payment status for the order ID in the notification before it checked the notification hash, and it did not restrict the status to known values. This makes it possible for unauthenticated attackers to send forged payment notifications that overwrite the stored remote payment status (for example with SUCCESS) of any order awaiting an Autopay payment. Genuine notifications for that order are then treated as already processed, so a paid order may never be marked as paid.

## References

- https://wpsec.com/vuln/WPSEC-2026-1766/
- https://plugins.svn.wordpress.org/platnosci-online-blue-media/tags/5.1.0/
- https://wordpress.org/plugins/platnosci-online-blue-media/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1766/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.