# Paytrail for WooCommerce <= 2.9.0 - Unauthenticated Insufficient Verification of Data Authenticity via Refund Callback

- **ID:** WPSEC-2026-2943
- **Plugin:** Paytrail for WooCommerce (`paytrail-for-woocommerce`), https://wordpress.org/plugins/paytrail-for-woocommerce/
- **Affected versions:** all versions before 2.10.0
- **Fixed in:** 2.10.0 (Update to 2.10.0 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/paytrail-for-woocommerce
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2943/

## Description

The Paytrail for WooCommerce plugin for WordPress is vulnerable to insufficient verification of data authenticity via the refund callback in all versions up to, and including, 2.9.0, due to the handler taking the refund outcome (success or cancel) and the order ID from unsigned URL parameters, and not tying the signed checkout parameters to the refund's transaction. This makes it possible for unauthenticated attackers who know a refund's unique identifier to replay validly signed Paytrail parameters from another transaction to mark a pending refund as completed or delete it, and to add refund notes to arbitrary orders.

## References

- https://wpsec.com/vuln/WPSEC-2026-2943/
- https://plugins.svn.wordpress.org/paytrail-for-woocommerce/tags/2.10.0/
- https://wordpress.org/plugins/paytrail-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2943/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.