{
 "id": "WPSEC-2026-2557",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2557/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2557/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2557/index.md",
 "title": "Checkout.com Payment Gateway <= 5.1.4.4 - Unauthenticated Insecure Direct Object Reference via Saved Payment Token",
 "description": "The Checkout.com Payment Gateway plugin for WordPress is vulnerable to Insecure Direct Object Reference via the saved-card token parameters ('wc-wc_checkout_com_cards-payment-token' and 'wc-wc_checkout_com_flow-payment-token') in all versions up to, and including, 5.1.4.4. This is due to the plugin loading the saved payment token ID supplied in the request without verifying that the token belongs to the current customer or order. This makes it possible for unauthenticated attackers (through guest checkout) and authenticated customers to pay for their orders with another customer's saved card, because token IDs are sequential.",
 "plugin": {
  "slug": "checkout-com-unified-payments-api",
  "name": "Checkout.com Payment Gateway",
  "full_name": "Checkout.com Payment Gateway",
  "wordpress_org": "https://wordpress.org/plugins/checkout-com-unified-payments-api/",
  "advisories_url": "https://wpsec.com/vuln/plugin/checkout-com-unified-payments-api/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/checkout-com-unified-payments-api"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.1.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.1.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.1.5",
 "remediation": "Update to 5.1.5 or later.",
 "fix_released": "2026-11-04T09:26:37+00:00",
 "published": "2026-11-05T09:48:23+00:00",
 "updated": "2026-11-04T13:59:20.847715+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2557/",
  "https://plugins.svn.wordpress.org/checkout-com-unified-payments-api/tags/5.1.5/",
  "https://wordpress.org/plugins/checkout-com-unified-payments-api/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/checkout-com-unified-payments-api",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-05"
 }
}