Checkout.com Payment Gateway <= 5.1.4.4 - Unauthenticated Payment Verification Bypass via Flow Checkout
- ID
- WPSEC-2026-2556
- Plugin
- Checkout.com Payment Gateway (checkout-com-unified-payments-api)
- Affected
- from 5.0.0 before 5.1.5
- Remediation
- Update to 5.1.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-05
- Attack surface
- Checkout.com Payment Gateway on WPSec AttackSurface
- Fix released
- Published
Description
The Checkout.com Payment Gateway plugin for WordPress is vulnerable to a payment verification bypass via the Flow checkout payment processing ('cko-flow-payment-id' / 'cko-payment-id' parameters) in all versions up to, and including, 5.1.4.4. This is due to the plugin accepting any approved Checkout.com payment ID supplied in the request without verifying that the payment belongs to the order or matches its amount and currency, and to it treating the payment as approved whenever the Checkout.com SDK was unavailable. This makes it possible for unauthenticated attackers to have orders marked as paid without paying for them, for example by reusing the ID of a cheaper payment they made earlier.
References
- https://wpsec.com/vuln/WPSEC-2026-2556/
- https://plugins.svn.wordpress.org/checkout-com-unified-payments-api/tags/5.1.5/
- https://wordpress.org/plugins/checkout-com-unified-payments-api/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS