{
 "id": "WPSEC-2026-2049",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2049/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2049/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2049/index.md",
 "title": "payment-gateway-for-phonepe-and-for-woocommerce <= 1.0.12 - Unauthenticated Insecure Direct Object Reference via 'order_id' Parameter",
 "description": "The payment-gateway-for-phonepe-and-for-woocommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'order_id' parameter of the PhonePe payment return URL (wc-api=PGPPW_Gateway, pgppw_phonepe_action=process_payment) in all versions up to, and including, 1.0.12. This is due to the handler acting on any supplied order ID without validating the order key or ownership, and then redirecting to the order-received URL that contains the order key. This makes it possible for unauthenticated attackers to enumerate order IDs, obtain the order keys of orders paid through PhonePe and view those customers' order details, such as names, addresses and purchased items, and to add payment-failure notes to other orders.",
 "plugin": {
  "slug": "payment-gateway-for-phonepe-and-for-woocommerce",
  "name": "payment-gateway-for-phonepe-and-for-woocommerce",
  "full_name": "payment-gateway-for-phonepe-and-for-woocommerce",
  "wordpress_org": "https://wordpress.org/plugins/payment-gateway-for-phonepe-and-for-woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/payment-gateway-for-phonepe-and-for-woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/payment-gateway-for-phonepe-and-for-woocommerce"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.0.13",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.0.13"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.0.13",
 "remediation": "Update to 1.0.13 or later.",
 "fix_released": "2026-10-29T11:03:19+00:00",
 "published": "2026-10-30T11:45:14+00:00",
 "updated": "2026-10-29T17:44:42.827818+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2049/",
  "https://plugins.svn.wordpress.org/payment-gateway-for-phonepe-and-for-woocommerce/tags/1.0.13/",
  "https://wordpress.org/plugins/payment-gateway-for-phonepe-and-for-woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/payment-gateway-for-phonepe-and-for-woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}