Checkout.com Payment Gateway <= 5.1.6 - Unauthenticated Missing Authorization to Order Modification via Flow Payment Session and Payment Return Handlers
- ID
- WPSEC-2026-2959
- Plugin
- Checkout.com Payment Gateway (checkout-com-unified-payments-api)
- Affected
- from 5.0.0 before 5.1.7
- Remediation
- Update to 5.1.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-12
- Attack surface
- Checkout.com Payment Gateway on WPSec AttackSurface
- Fix released
- Published
Description
The Checkout.com Payment Gateway plugin for WordPress is vulnerable to unauthorized order modification in all versions up to, and including, 5.1.6. The public Flow payment-session AJAX action (cko_flow_create_payment_session) passes the browser's reference, metadata (including order_id) and line items to Checkout.com, and also the amount when the cart is empty. The card payment return handler (wc-api=wc_checkoutcom_callback) then acts on the order named in the payment's metadata without checking that the request is linked to that order. The Flow 3D Secure return (wc-api=wc_checkoutcom_flow_process) builds a new order from the payment's details when no order matches. This makes it possible for unauthenticated attackers to create a payment that names another customer's unpaid order, move that order to on-hold, and be redirected to its order-received URL, which carries the order key. Attackers can also create orders made up of line items and prices they choose.
References
- https://wpsec.com/vuln/WPSEC-2026-2959/
- https://plugins.svn.wordpress.org/checkout-com-unified-payments-api/tags/5.1.7/
- https://wordpress.org/plugins/checkout-com-unified-payments-api/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS