# Checkout.com Payment Gateway <= 5.1.4.4 - Unauthenticated Path Traversal to Sensitive Information Exposure via 'paymentId' Parameter

- **ID:** WPSEC-2026-2559
- **Plugin:** Checkout.com Payment Gateway (`checkout-com-unified-payments-api`), https://wordpress.org/plugins/checkout-com-unified-payments-api/
- **Affected versions:** from 5.0.0 before 5.1.5
- **Fixed in:** 5.1.5 (Update to 5.1.5 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-22
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/checkout-com-unified-payments-api
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2559/

## Description

The Checkout.com Payment Gateway plugin for WordPress is vulnerable to Path Traversal via the 'paymentId' parameter of the /ckoplugin/v1/payment-status REST route in all versions up to, and including, 5.1.4.4. This is due to the plugin appending the unvalidated payment ID to the Checkout.com API URL and requesting it with the store's secret key, and returning the full API response to any visitor holding the publicly available checkout nonce. This makes it possible for unauthenticated attackers to read arbitrary Checkout.com API resources of the merchant account, as well as full payment details such as customer names, email addresses, addresses and card details.

## References

- https://wpsec.com/vuln/WPSEC-2026-2559/
- https://plugins.svn.wordpress.org/checkout-com-unified-payments-api/tags/5.1.5/
- https://wordpress.org/plugins/checkout-com-unified-payments-api/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2559/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.