# payment-gateway-for-phonepe-and-for-woocommerce <= 1.0.12 - Unauthenticated Insecure Direct Object Reference via 'order_id' Parameter

- **ID:** WPSEC-2026-2049
- **Plugin:** payment-gateway-for-phonepe-and-for-woocommerce (`payment-gateway-for-phonepe-and-for-woocommerce`), https://wordpress.org/plugins/payment-gateway-for-phonepe-and-for-woocommerce/
- **Affected versions:** all versions before 1.0.13
- **Fixed in:** 1.0.13 (Update to 1.0.13 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/payment-gateway-for-phonepe-and-for-woocommerce
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2049/

## Description

The payment-gateway-for-phonepe-and-for-woocommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'order_id' parameter of the PhonePe payment return URL (wc-api=PGPPW_Gateway, pgppw_phonepe_action=process_payment) in all versions up to, and including, 1.0.12. This is due to the handler acting on any supplied order ID without validating the order key or ownership, and then redirecting to the order-received URL that contains the order key. This makes it possible for unauthenticated attackers to enumerate order IDs, obtain the order keys of orders paid through PhonePe and view those customers' order details, such as names, addresses and purchased items, and to add payment-failure notes to other orders.

## References

- https://wpsec.com/vuln/WPSEC-2026-2049/
- https://plugins.svn.wordpress.org/payment-gateway-for-phonepe-and-for-woocommerce/tags/1.0.13/
- https://wordpress.org/plugins/payment-gateway-for-phonepe-and-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2049/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.