Vulnerabilities / Checkout.com Payment Gateway / WPSEC-2026-2560
Checkout.com Payment Gateway <= 5.1.4.4 - Unauthenticated Webhook Signature Forgery
Medium 5.9
CWE-347Fixed in 5.1.5
- ID
- WPSEC-2026-2560
- Plugin
- Checkout.com Payment Gateway (checkout-com-unified-payments-api)
- Affected
- all versions before 5.1.5
- Remediation
- Update to 5.1.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weakness
- CWE-347
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-05
- Attack surface
- Checkout.com Payment Gateway on WPSec AttackSurface
- Fix released
- Published
Description
The Checkout.com Payment Gateway plugin for WordPress is vulnerable to webhook signature forgery in the Flow and classic card webhook handlers in all versions up to, and including, 5.1.4.4. This is due to the HMAC signing key being the known value '' (or 'Bearer ' for NAS accounts) when no secret key is configured. This makes it possible for unauthenticated attackers to send forged payment notifications that change order statuses, such as marking orders as paid, on sites where the plugin is active but no secret key has been configured.
References
- https://wpsec.com/vuln/WPSEC-2026-2560/
- https://plugins.svn.wordpress.org/checkout-com-unified-payments-api/tags/5.1.5/
- https://wordpress.org/plugins/checkout-com-unified-payments-api/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS