{
 "id": "WPSEC-2026-2558",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2558/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2558/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2558/index.md",
 "title": "Checkout.com Payment Gateway <= 5.1.4.4 - Unauthenticated Insecure Direct Object Reference to Order Status Modification via 3DS Return Handler",
 "description": "The Checkout.com Payment Gateway plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'order_id' parameter of the Flow 3DS return endpoint (wc-api=wc_checkoutcom_flow_process with status=failed) in all versions up to, and including, 5.1.4.4. This is due to the handler loading the order named by the supplied ID without checking the order key and setting it to failed regardless of its current status, and storing the supplied payment ID on it. This makes it possible for unauthenticated attackers to set any order, including paid ones, to 'failed' and overwrite its stored Checkout.com payment ID.",
 "plugin": {
  "slug": "checkout-com-unified-payments-api",
  "name": "Checkout.com Payment Gateway",
  "full_name": "Checkout.com Payment Gateway",
  "wordpress_org": "https://wordpress.org/plugins/checkout-com-unified-payments-api/",
  "advisories_url": "https://wpsec.com/vuln/plugin/checkout-com-unified-payments-api/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/checkout-com-unified-payments-api"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.1.0",
    "from_inclusive": true,
    "to": "5.1.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.1.0 before 5.1.5"
  ]
 },
 "introduced_in": "5.1.0",
 "fixed_in": "5.1.5",
 "remediation": "Update to 5.1.5 or later.",
 "fix_released": "2026-11-04T09:26:37+00:00",
 "published": "2026-11-05T09:48:23+00:00",
 "updated": "2026-11-04T13:59:20.847715+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2558/",
  "https://plugins.svn.wordpress.org/checkout-com-unified-payments-api/tags/5.1.5/",
  "https://wordpress.org/plugins/checkout-com-unified-payments-api/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/checkout-com-unified-payments-api",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-05"
 }
}