Checkout.com Payment Gateway <= 5.1.4.4 - Unauthenticated Insecure Direct Object Reference via Saved Payment Token
- ID
- WPSEC-2026-2557
- Plugin
- Checkout.com Payment Gateway (checkout-com-unified-payments-api)
- Affected
- all versions before 5.1.5
- Remediation
- Update to 5.1.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-05
- Attack surface
- Checkout.com Payment Gateway on WPSec AttackSurface
- Fix released
- Published
Description
The Checkout.com Payment Gateway plugin for WordPress is vulnerable to Insecure Direct Object Reference via the saved-card token parameters ('wc-wc_checkout_com_cards-payment-token' and 'wc-wc_checkout_com_flow-payment-token') in all versions up to, and including, 5.1.4.4. This is due to the plugin loading the saved payment token ID supplied in the request without verifying that the token belongs to the current customer or order. This makes it possible for unauthenticated attackers (through guest checkout) and authenticated customers to pay for their orders with another customer's saved card, because token IDs are sequential.
References
- https://wpsec.com/vuln/WPSEC-2026-2557/
- https://plugins.svn.wordpress.org/checkout-com-unified-payments-api/tags/5.1.5/
- https://wordpress.org/plugins/checkout-com-unified-payments-api/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS