{
 "id": "WPSEC-2026-2958",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2958/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2958/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2958/index.md",
 "title": "Pay. Payment Methods for WooCommerce <= 4.1.1 - Unauthenticated Insecure Direct Object Reference to Order Status Manipulation via 'extra1' Parameter",
 "description": "The Pay. Payment Methods for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'extra1' parameter of the payment exchange (wc-api=Wc_Pay_Gateway_Exchange) endpoint in all versions up to, and including, 4.1.1, due to the plugin taking the WooCommerce order ID from the user-supplied 'extra1' request parameter when no local transaction matches the supplied Pay. order ID. The plugin then links that Pay. transaction to the chosen order and applies the transaction's Pay. status to it. This makes it possible for unauthenticated attackers who know a Pay. transaction on the store's Pay. account that is not recorded in the plugin's local transaction table to attach it to an arbitrary order and change that order's status. For example, the order can be marked as paid when the amounts match or amount validation is disabled, put on hold when they do not, or cancelled.",
 "plugin": {
  "slug": "woocommerce-paynl-payment-methods",
  "name": "Pay. Payment Methods for WooCommerce",
  "full_name": "Pay. Payment Methods for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/woocommerce-paynl-payment-methods/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woocommerce-paynl-payment-methods/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woocommerce-paynl-payment-methods"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.20.3",
    "from_inclusive": true,
    "to": "4.2.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.20.3 before 4.2.0"
  ]
 },
 "introduced_in": "3.20.3",
 "fixed_in": "4.2.0",
 "remediation": "Update to 4.2.0 or later.",
 "fix_released": "2026-11-11T14:45:10+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:11:53.439004+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2958/",
  "https://plugins.svn.wordpress.org/woocommerce-paynl-payment-methods/tags/4.2.0/",
  "https://wordpress.org/plugins/woocommerce-paynl-payment-methods/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woocommerce-paynl-payment-methods",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-12"
 }
}