payment-gateway-for-phonepe-and-for-woocommerce <= 1.0.12 - Unauthenticated Authentication Bypass via Webhook Endpoint
- ID
- WPSEC-2026-2050
- Plugin
- payment-gateway-for-phonepe-and-for-woocommerce (payment-gateway-for-phonepe-and-for-woocommerce)
- Affected
- all versions before 1.0.13
- Remediation
- Update to 1.0.13 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weakness
- CWE-287
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- payment-gateway-for-phonepe-and-for-woocommerce on WPSec AttackSurface
- Fix released
- Published
Description
The payment-gateway-for-phonepe-and-for-woocommerce plugin for WordPress is vulnerable to Authentication Bypass via the PhonePe webhook endpoint (wc-api=pgppw_webhook) in all versions up to, and including, 1.0.12. This is due to the webhook comparing the Authorization header against a SHA-256 hash of webhook credentials that the plugin never stores, so the expected value is the publicly computable hash of an empty username and password, and to the handler trusting the order state in the payload without checking it with PhonePe. This makes it possible for unauthenticated attackers to send forged webhook events that mark arbitrary WooCommerce orders as paid, failed or refunded without any payment.
References
- https://wpsec.com/vuln/WPSEC-2026-2050/
- https://plugins.svn.wordpress.org/payment-gateway-for-phonepe-and-for-woocommerce/tags/1.0.13/
- https://wordpress.org/plugins/payment-gateway-for-phonepe-and-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS