Checkout.com Payment Gateway <= 5.1.4.4 - Unauthenticated Insecure Direct Object Reference to Order Status Modification via 3DS Return Handler
- ID
- WPSEC-2026-2558
- Plugin
- Checkout.com Payment Gateway (checkout-com-unified-payments-api)
- Affected
- from 5.1.0 before 5.1.5
- Remediation
- Update to 5.1.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-05
- Attack surface
- Checkout.com Payment Gateway on WPSec AttackSurface
- Fix released
- Published
Description
The Checkout.com Payment Gateway plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'order_id' parameter of the Flow 3DS return endpoint (wc-api=wc_checkoutcom_flow_process with status=failed) in all versions up to, and including, 5.1.4.4. This is due to the handler loading the order named by the supplied ID without checking the order key and setting it to failed regardless of its current status, and storing the supplied payment ID on it. This makes it possible for unauthenticated attackers to set any order, including paid ones, to 'failed' and overwrite its stored Checkout.com payment ID.
References
- https://wpsec.com/vuln/WPSEC-2026-2558/
- https://plugins.svn.wordpress.org/checkout-com-unified-payments-api/tags/5.1.5/
- https://wordpress.org/plugins/checkout-com-unified-payments-api/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS