# Checkout.com Payment Gateway <= 5.1.5 - Unauthenticated Insufficient Payment Verification via Card Payment Return Handler

- **ID:** WPSEC-2026-2807
- **Plugin:** Checkout.com Payment Gateway (`checkout-com-unified-payments-api`), https://wordpress.org/plugins/checkout-com-unified-payments-api/
- **Affected versions:** all versions before 5.1.6
- **Fixed in:** 5.1.6 (Update to 5.1.6 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/checkout-com-unified-payments-api
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2807/

## Description

The Checkout.com Payment Gateway plugin for WordPress is vulnerable to insufficient verification of data authenticity via the card payment return handler (wc-api=wc_checkoutcom_callback) in all versions up to, and including, 5.1.5. This is due to the handler loading the order named in the payment's metadata and moving it to the authorised or captured status without checking that the payment's amount and currency match that order or that the payment was made for it. On the order-pay page, the order used for that metadata could also be swapped through the 'order_id' query parameter, and Flow payment session metadata was taken from the browser. This makes it possible for unauthenticated attackers to have an order marked as paid with a payment for a lower amount or for a different order.

## References

- https://wpsec.com/vuln/WPSEC-2026-2807/
- https://plugins.svn.wordpress.org/checkout-com-unified-payments-api/tags/5.1.6/
- https://wordpress.org/plugins/checkout-com-unified-payments-api/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2807/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.