{
 "id": "WPSEC-2026-2560",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2560/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2560/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2560/index.md",
 "title": "Checkout.com Payment Gateway <= 5.1.4.4 - Unauthenticated Webhook Signature Forgery",
 "description": "The Checkout.com Payment Gateway plugin for WordPress is vulnerable to webhook signature forgery in the Flow and classic card webhook handlers in all versions up to, and including, 5.1.4.4. This is due to the HMAC signing key being the known value '' (or 'Bearer ' for NAS accounts) when no secret key is configured. This makes it possible for unauthenticated attackers to send forged payment notifications that change order statuses, such as marking orders as paid, on sites where the plugin is active but no secret key has been configured.",
 "plugin": {
  "slug": "checkout-com-unified-payments-api",
  "name": "Checkout.com Payment Gateway",
  "full_name": "Checkout.com Payment Gateway",
  "wordpress_org": "https://wordpress.org/plugins/checkout-com-unified-payments-api/",
  "advisories_url": "https://wpsec.com/vuln/plugin/checkout-com-unified-payments-api/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/checkout-com-unified-payments-api"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-347"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.1.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.1.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.1.5",
 "remediation": "Update to 5.1.5 or later.",
 "fix_released": "2026-11-04T09:26:37+00:00",
 "published": "2026-11-05T09:48:23+00:00",
 "updated": "2026-11-04T13:59:20.847715+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2560/",
  "https://plugins.svn.wordpress.org/checkout-com-unified-payments-api/tags/5.1.5/",
  "https://wordpress.org/plugins/checkout-com-unified-payments-api/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/checkout-com-unified-payments-api",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-05"
 }
}