# BitPay Checkout for WooCommerce <= 7.1.4 - Unauthenticated Insecure Direct Object Reference to BitPay Invoice Creation

- **ID:** WPSEC-2026-2287
- **Plugin:** BitPay Checkout for WooCommerce (`bitpay-checkout-for-woocommerce`), https://wordpress.org/plugins/bitpay-checkout-for-woocommerce/
- **Affected versions:** all versions before 7.1.5
- **Fixed in:** 7.1.5 (Update to 7.1.5 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/bitpay-checkout-for-woocommerce
- **Fix released:** 2026-10-30
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2287/

## Description

The BitPay Checkout for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via the order-received page in all versions up to, and including, 7.1.4, due to missing validation of the order key before a BitPay invoice is created for the order ID in the URL. The plugin only checked that the order used the BitPay payment gateway and still needed payment. This makes it possible for unauthenticated attackers who know or guess an order ID to create BitPay invoices for other customers' unpaid orders, which replaces the order's stored transaction ID and can expose the order key placed in the invoice's return URL.

## References

- https://wpsec.com/vuln/WPSEC-2026-2287/
- https://plugins.svn.wordpress.org/bitpay-checkout-for-woocommerce/tags/7.1.5/
- https://wordpress.org/plugins/bitpay-checkout-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2287/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.