# Checkout.com Payment Gateway <= 5.1.4.4 - Unauthenticated Insecure Direct Object Reference to Order Status Modification via 3DS Return Handler

- **ID:** WPSEC-2026-2558
- **Plugin:** Checkout.com Payment Gateway (`checkout-com-unified-payments-api`), https://wordpress.org/plugins/checkout-com-unified-payments-api/
- **Affected versions:** from 5.1.0 before 5.1.5
- **Fixed in:** 5.1.5 (Update to 5.1.5 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/checkout-com-unified-payments-api
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2558/

## Description

The Checkout.com Payment Gateway plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'order_id' parameter of the Flow 3DS return endpoint (wc-api=wc_checkoutcom_flow_process with status=failed) in all versions up to, and including, 5.1.4.4. This is due to the handler loading the order named by the supplied ID without checking the order key and setting it to failed regardless of its current status, and storing the supplied payment ID on it. This makes it possible for unauthenticated attackers to set any order, including paid ones, to 'failed' and overwrite its stored Checkout.com payment ID.

## References

- https://wpsec.com/vuln/WPSEC-2026-2558/
- https://plugins.svn.wordpress.org/checkout-com-unified-payments-api/tags/5.1.5/
- https://wordpress.org/plugins/checkout-com-unified-payments-api/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2558/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.