{
 "id": "WPSEC-2026-2806",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2806/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2806/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2806/index.md",
 "title": "Checkout.com Payment Gateway <= 5.1.5 - Unauthenticated Missing Authorization to Order Modification via Flow AJAX and 3DS Handlers",
 "description": "The Checkout.com Payment Gateway plugin for WordPress is vulnerable to Missing Authorization via the public Flow AJAX actions 'cko_flow_save_payment_session_id' and 'cko_flow_submit_payment_session' and the Flow 3DS return handler in all versions up to, and including, 5.1.5. This is due to missing order ownership checks on the 'order_id' parameter: guest orders were only required to be pending or failed, and the order key was optional. This makes it possible for unauthenticated attackers to act on other customers' pending or failed guest orders by ID: they can link their own payment sessions and payments to those orders, have them marked as failed, and get the order key back through the payment return URL, which exposes the order's details.",
 "plugin": {
  "slug": "checkout-com-unified-payments-api",
  "name": "Checkout.com Payment Gateway",
  "full_name": "Checkout.com Payment Gateway",
  "wordpress_org": "https://wordpress.org/plugins/checkout-com-unified-payments-api/",
  "advisories_url": "https://wpsec.com/vuln/plugin/checkout-com-unified-payments-api/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/checkout-com-unified-payments-api"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.0.0",
    "from_inclusive": true,
    "to": "5.1.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.0.0 before 5.1.6"
  ]
 },
 "introduced_in": "5.0.0",
 "fixed_in": "5.1.6",
 "remediation": "Update to 5.1.6 or later.",
 "fix_released": "2026-11-09T12:37:26+00:00",
 "published": "2026-11-10T12:49:28+00:00",
 "updated": "2026-11-09T23:34:44.054590+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2806/",
  "https://plugins.svn.wordpress.org/checkout-com-unified-payments-api/tags/5.1.6/",
  "https://wordpress.org/plugins/checkout-com-unified-payments-api/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/checkout-com-unified-payments-api",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-10"
 }
}