# Checkout.com Payment Gateway <= 5.1.4.4 - Unauthenticated Insecure Direct Object Reference via Saved Payment Token

- **ID:** WPSEC-2026-2557
- **Plugin:** Checkout.com Payment Gateway (`checkout-com-unified-payments-api`), https://wordpress.org/plugins/checkout-com-unified-payments-api/
- **Affected versions:** all versions before 5.1.5
- **Fixed in:** 5.1.5 (Update to 5.1.5 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/checkout-com-unified-payments-api
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2557/

## Description

The Checkout.com Payment Gateway plugin for WordPress is vulnerable to Insecure Direct Object Reference via the saved-card token parameters ('wc-wc_checkout_com_cards-payment-token' and 'wc-wc_checkout_com_flow-payment-token') in all versions up to, and including, 5.1.4.4. This is due to the plugin loading the saved payment token ID supplied in the request without verifying that the token belongs to the current customer or order. This makes it possible for unauthenticated attackers (through guest checkout) and authenticated customers to pay for their orders with another customer's saved card, because token IDs are sequential.

## References

- https://wpsec.com/vuln/WPSEC-2026-2557/
- https://plugins.svn.wordpress.org/checkout-com-unified-payments-api/tags/5.1.5/
- https://wordpress.org/plugins/checkout-com-unified-payments-api/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2557/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.