# Checkout.com Payment Gateway <= 5.1.4.4 - Unauthenticated Webhook Signature Forgery

- **ID:** WPSEC-2026-2560
- **Plugin:** Checkout.com Payment Gateway (`checkout-com-unified-payments-api`), https://wordpress.org/plugins/checkout-com-unified-payments-api/
- **Affected versions:** all versions before 5.1.5
- **Fixed in:** 5.1.5 (Update to 5.1.5 or later.)
- **Severity:** Medium 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
- **Weakness:** CWE-347
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/checkout-com-unified-payments-api
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2560/

## Description

The Checkout.com Payment Gateway plugin for WordPress is vulnerable to webhook signature forgery in the Flow and classic card webhook handlers in all versions up to, and including, 5.1.4.4. This is due to the HMAC signing key being the known value '' (or 'Bearer ' for NAS accounts) when no secret key is configured. This makes it possible for unauthenticated attackers to send forged payment notifications that change order statuses, such as marking orders as paid, on sites where the plugin is active but no secret key has been configured.

## References

- https://wpsec.com/vuln/WPSEC-2026-2560/
- https://plugins.svn.wordpress.org/checkout-com-unified-payments-api/tags/5.1.5/
- https://wordpress.org/plugins/checkout-com-unified-payments-api/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2560/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.