{
 "id": "WPSEC-2026-2943",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2943/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2943/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2943/index.md",
 "title": "Paytrail for WooCommerce <= 2.9.0 - Unauthenticated Insufficient Verification of Data Authenticity via Refund Callback",
 "description": "The Paytrail for WooCommerce plugin for WordPress is vulnerable to insufficient verification of data authenticity via the refund callback in all versions up to, and including, 2.9.0, due to the handler taking the refund outcome (success or cancel) and the order ID from unsigned URL parameters, and not tying the signed checkout parameters to the refund's transaction. This makes it possible for unauthenticated attackers who know a refund's unique identifier to replay validly signed Paytrail parameters from another transaction to mark a pending refund as completed or delete it, and to add refund notes to arbitrary orders.",
 "plugin": {
  "slug": "paytrail-for-woocommerce",
  "name": "Paytrail for WooCommerce",
  "full_name": "Paytrail for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/paytrail-for-woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/paytrail-for-woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/paytrail-for-woocommerce"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.10.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.10.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.10.0",
 "remediation": "Update to 2.10.0 or later.",
 "fix_released": "2026-11-11T07:36:28+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:11:14.319144+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2943/",
  "https://plugins.svn.wordpress.org/paytrail-for-woocommerce/tags/2.10.0/",
  "https://wordpress.org/plugins/paytrail-for-woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/paytrail-for-woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}