Vulnerabilities / ЮKassa для WooCommerce / WPSEC-2026-2509
ЮKassa для WooCommerce <= 2.17.3 - Unauthenticated Saved Payment Method Injection via Forged Payment Notification
Medium 5.3
CWE-345Fixed in 2.17.4
- ID
- WPSEC-2026-2509
- Plugin
- ЮKassa для WooCommerce (yookassa)
- Affected
- all versions before 2.17.4
- Remediation
- Update to 2.17.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-04
- Attack surface
- ЮKassa для WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The ЮKassa для WooCommerce plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity via the '?yookassa=callback' payment notification endpoint in all versions up to, and including, 2.17.3, due to the plugin trusting the payment object in the unverified notification body (metadata such as wp_user_id, the payment method and the payment status) and acting on it before it re-fetches the payment from the YooKassa API. This makes it possible for unauthenticated attackers to send forged notifications that save attacker-defined payment method tokens to arbitrary customer accounts.
References
- https://wpsec.com/vuln/WPSEC-2026-2509/
- https://plugins.svn.wordpress.org/yookassa/tags/2.17.4/
- https://wordpress.org/plugins/yookassa/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS