Checkout.com Payment Gateway <= 5.1.5 - Unauthenticated Insufficient Payment Verification via Card Payment Return Handler
- ID
- WPSEC-2026-2807
- Plugin
- Checkout.com Payment Gateway (checkout-com-unified-payments-api)
- Affected
- all versions before 5.1.6
- Remediation
- Update to 5.1.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-10
- Attack surface
- Checkout.com Payment Gateway on WPSec AttackSurface
- Fix released
- Published
Description
The Checkout.com Payment Gateway plugin for WordPress is vulnerable to insufficient verification of data authenticity via the card payment return handler (wc-api=wc_checkoutcom_callback) in all versions up to, and including, 5.1.5. This is due to the handler loading the order named in the payment's metadata and moving it to the authorised or captured status without checking that the payment's amount and currency match that order or that the payment was made for it. On the order-pay page, the order used for that metadata could also be swapped through the 'order_id' query parameter, and Flow payment session metadata was taken from the browser. This makes it possible for unauthenticated attackers to have an order marked as paid with a payment for a lower amount or for a different order.
References
- https://wpsec.com/vuln/WPSEC-2026-2807/
- https://plugins.svn.wordpress.org/checkout-com-unified-payments-api/tags/5.1.6/
- https://wordpress.org/plugins/checkout-com-unified-payments-api/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS