# Checkout.com Payment Gateway <= 5.1.4.4 - Unauthenticated Payment Verification Bypass via Flow Checkout

- **ID:** WPSEC-2026-2556
- **Plugin:** Checkout.com Payment Gateway (`checkout-com-unified-payments-api`), https://wordpress.org/plugins/checkout-com-unified-payments-api/
- **Affected versions:** from 5.0.0 before 5.1.5
- **Fixed in:** 5.1.5 (Update to 5.1.5 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/checkout-com-unified-payments-api
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2556/

## Description

The Checkout.com Payment Gateway plugin for WordPress is vulnerable to a payment verification bypass via the Flow checkout payment processing ('cko-flow-payment-id' / 'cko-payment-id' parameters) in all versions up to, and including, 5.1.4.4. This is due to the plugin accepting any approved Checkout.com payment ID supplied in the request without verifying that the payment belongs to the order or matches its amount and currency, and to it treating the payment as approved whenever the Checkout.com SDK was unavailable. This makes it possible for unauthenticated attackers to have orders marked as paid without paying for them, for example by reusing the ID of a cheaper payment they made earlier.

## References

- https://wpsec.com/vuln/WPSEC-2026-2556/
- https://plugins.svn.wordpress.org/checkout-com-unified-payments-api/tags/5.1.5/
- https://wordpress.org/plugins/checkout-com-unified-payments-api/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2556/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.