Checkout.com Payment Gateway <= 5.1.4.4 - Unauthenticated Path Traversal to Sensitive Information Exposure via 'paymentId' Parameter
- ID
- WPSEC-2026-2559
- Plugin
- Checkout.com Payment Gateway (checkout-com-unified-payments-api)
- Affected
- from 5.0.0 before 5.1.5
- Remediation
- Update to 5.1.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-22
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-05
- Attack surface
- Checkout.com Payment Gateway on WPSec AttackSurface
- Fix released
- Published
Description
The Checkout.com Payment Gateway plugin for WordPress is vulnerable to Path Traversal via the 'paymentId' parameter of the /ckoplugin/v1/payment-status REST route in all versions up to, and including, 5.1.4.4. This is due to the plugin appending the unvalidated payment ID to the Checkout.com API URL and requesting it with the store's secret key, and returning the full API response to any visitor holding the publicly available checkout nonce. This makes it possible for unauthenticated attackers to read arbitrary Checkout.com API resources of the merchant account, as well as full payment details such as customer names, email addresses, addresses and card details.
References
- https://wpsec.com/vuln/WPSEC-2026-2559/
- https://plugins.svn.wordpress.org/checkout-com-unified-payments-api/tags/5.1.5/
- https://wordpress.org/plugins/checkout-com-unified-payments-api/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS