# payment-gateway-for-phonepe-and-for-woocommerce <= 1.0.12 - Unauthenticated Authentication Bypass via Webhook Endpoint

- **ID:** WPSEC-2026-2050
- **Plugin:** payment-gateway-for-phonepe-and-for-woocommerce (`payment-gateway-for-phonepe-and-for-woocommerce`), https://wordpress.org/plugins/payment-gateway-for-phonepe-and-for-woocommerce/
- **Affected versions:** all versions before 1.0.13
- **Fixed in:** 1.0.13 (Update to 1.0.13 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
- **Weakness:** CWE-287
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/payment-gateway-for-phonepe-and-for-woocommerce
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2050/

## Description

The payment-gateway-for-phonepe-and-for-woocommerce plugin for WordPress is vulnerable to Authentication Bypass via the PhonePe webhook endpoint (wc-api=pgppw_webhook) in all versions up to, and including, 1.0.12. This is due to the webhook comparing the Authorization header against a SHA-256 hash of webhook credentials that the plugin never stores, so the expected value is the publicly computable hash of an empty username and password, and to the handler trusting the order state in the payload without checking it with PhonePe. This makes it possible for unauthenticated attackers to send forged webhook events that mark arbitrary WooCommerce orders as paid, failed or refunded without any payment.

## References

- https://wpsec.com/vuln/WPSEC-2026-2050/
- https://plugins.svn.wordpress.org/payment-gateway-for-phonepe-and-for-woocommerce/tags/1.0.13/
- https://wordpress.org/plugins/payment-gateway-for-phonepe-and-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2050/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.