payment-gateway-for-phonepe-and-for-woocommerce <= 1.0.12 - Unauthenticated Insecure Direct Object Reference via 'order_id' Parameter
- ID
- WPSEC-2026-2049
- Plugin
- payment-gateway-for-phonepe-and-for-woocommerce (payment-gateway-for-phonepe-and-for-woocommerce)
- Affected
- all versions before 1.0.13
- Remediation
- Update to 1.0.13 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- payment-gateway-for-phonepe-and-for-woocommerce on WPSec AttackSurface
- Fix released
- Published
Description
The payment-gateway-for-phonepe-and-for-woocommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'order_id' parameter of the PhonePe payment return URL (wc-api=PGPPW_Gateway, pgppw_phonepe_action=process_payment) in all versions up to, and including, 1.0.12. This is due to the handler acting on any supplied order ID without validating the order key or ownership, and then redirecting to the order-received URL that contains the order key. This makes it possible for unauthenticated attackers to enumerate order IDs, obtain the order keys of orders paid through PhonePe and view those customers' order details, such as names, addresses and purchased items, and to add payment-failure notes to other orders.
References
- https://wpsec.com/vuln/WPSEC-2026-2049/
- https://plugins.svn.wordpress.org/payment-gateway-for-phonepe-and-for-woocommerce/tags/1.0.13/
- https://wordpress.org/plugins/payment-gateway-for-phonepe-and-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS