{
 "id": "WPSEC-2026-2050",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2050/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2050/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2050/index.md",
 "title": "payment-gateway-for-phonepe-and-for-woocommerce <= 1.0.12 - Unauthenticated Authentication Bypass via Webhook Endpoint",
 "description": "The payment-gateway-for-phonepe-and-for-woocommerce plugin for WordPress is vulnerable to Authentication Bypass via the PhonePe webhook endpoint (wc-api=pgppw_webhook) in all versions up to, and including, 1.0.12. This is due to the webhook comparing the Authorization header against a SHA-256 hash of webhook credentials that the plugin never stores, so the expected value is the publicly computable hash of an empty username and password, and to the handler trusting the order state in the payload without checking it with PhonePe. This makes it possible for unauthenticated attackers to send forged webhook events that mark arbitrary WooCommerce orders as paid, failed or refunded without any payment.",
 "plugin": {
  "slug": "payment-gateway-for-phonepe-and-for-woocommerce",
  "name": "payment-gateway-for-phonepe-and-for-woocommerce",
  "full_name": "payment-gateway-for-phonepe-and-for-woocommerce",
  "wordpress_org": "https://wordpress.org/plugins/payment-gateway-for-phonepe-and-for-woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/payment-gateway-for-phonepe-and-for-woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/payment-gateway-for-phonepe-and-for-woocommerce"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-287"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.0.13",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.0.13"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.0.13",
 "remediation": "Update to 1.0.13 or later.",
 "fix_released": "2026-10-29T11:03:19+00:00",
 "published": "2026-10-30T11:45:14+00:00",
 "updated": "2026-10-29T17:44:42.827818+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2050/",
  "https://plugins.svn.wordpress.org/payment-gateway-for-phonepe-and-for-woocommerce/tags/1.0.13/",
  "https://wordpress.org/plugins/payment-gateway-for-phonepe-and-for-woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/payment-gateway-for-phonepe-and-for-woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}