BitPay Checkout for WooCommerce <= 7.1.4 - Unauthenticated Insecure Direct Object Reference to BitPay Invoice Creation
- ID
- WPSEC-2026-2287
- Plugin
- BitPay Checkout for WooCommerce (bitpay-checkout-for-woocommerce)
- Affected
- all versions before 7.1.5
- Remediation
- Update to 7.1.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-03
- Attack surface
- BitPay Checkout for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The BitPay Checkout for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via the order-received page in all versions up to, and including, 7.1.4, due to missing validation of the order key before a BitPay invoice is created for the order ID in the URL. The plugin only checked that the order used the BitPay payment gateway and still needed payment. This makes it possible for unauthenticated attackers who know or guess an order ID to create BitPay invoices for other customers' unpaid orders, which replaces the order's stored transaction ID and can expose the order key placed in the invoice's return URL.
References
- https://wpsec.com/vuln/WPSEC-2026-2287/
- https://plugins.svn.wordpress.org/bitpay-checkout-for-woocommerce/tags/7.1.5/
- https://wordpress.org/plugins/bitpay-checkout-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS