Paytrail for WooCommerce <= 2.9.0 - Unauthenticated Insufficient Verification of Data Authenticity via Refund Callback
- ID
- WPSEC-2026-2943
- Plugin
- Paytrail for WooCommerce (paytrail-for-woocommerce)
- Affected
- all versions before 2.10.0
- Remediation
- Update to 2.10.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Paytrail for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Paytrail for WooCommerce plugin for WordPress is vulnerable to insufficient verification of data authenticity via the refund callback in all versions up to, and including, 2.9.0, due to the handler taking the refund outcome (success or cancel) and the order ID from unsigned URL parameters, and not tying the signed checkout parameters to the refund's transaction. This makes it possible for unauthenticated attackers who know a refund's unique identifier to replay validly signed Paytrail parameters from another transaction to mark a pending refund as completed or delete it, and to add refund notes to arbitrary orders.
References
- https://wpsec.com/vuln/WPSEC-2026-2943/
- https://plugins.svn.wordpress.org/paytrail-for-woocommerce/tags/2.10.0/
- https://wordpress.org/plugins/paytrail-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS