{
 "id": "WPSEC-2026-2807",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2807/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2807/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2807/index.md",
 "title": "Checkout.com Payment Gateway <= 5.1.5 - Unauthenticated Insufficient Payment Verification via Card Payment Return Handler",
 "description": "The Checkout.com Payment Gateway plugin for WordPress is vulnerable to insufficient verification of data authenticity via the card payment return handler (wc-api=wc_checkoutcom_callback) in all versions up to, and including, 5.1.5. This is due to the handler loading the order named in the payment's metadata and moving it to the authorised or captured status without checking that the payment's amount and currency match that order or that the payment was made for it. On the order-pay page, the order used for that metadata could also be swapped through the 'order_id' query parameter, and Flow payment session metadata was taken from the browser. This makes it possible for unauthenticated attackers to have an order marked as paid with a payment for a lower amount or for a different order.",
 "plugin": {
  "slug": "checkout-com-unified-payments-api",
  "name": "Checkout.com Payment Gateway",
  "full_name": "Checkout.com Payment Gateway",
  "wordpress_org": "https://wordpress.org/plugins/checkout-com-unified-payments-api/",
  "advisories_url": "https://wpsec.com/vuln/plugin/checkout-com-unified-payments-api/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/checkout-com-unified-payments-api"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.1.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.1.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.1.6",
 "remediation": "Update to 5.1.6 or later.",
 "fix_released": "2026-11-09T12:37:26+00:00",
 "published": "2026-11-10T12:49:28+00:00",
 "updated": "2026-11-09T23:34:44.054590+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2807/",
  "https://plugins.svn.wordpress.org/checkout-com-unified-payments-api/tags/5.1.6/",
  "https://wordpress.org/plugins/checkout-com-unified-payments-api/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/checkout-com-unified-payments-api",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-10"
 }
}