# Checkout.com Payment Gateway <= 5.1.6 - Unauthenticated Missing Authorization to Order Modification via Flow Payment Session and Payment Return Handlers

- **ID:** WPSEC-2026-2959
- **Plugin:** Checkout.com Payment Gateway (`checkout-com-unified-payments-api`), https://wordpress.org/plugins/checkout-com-unified-payments-api/
- **Affected versions:** from 5.0.0 before 5.1.7
- **Fixed in:** 5.1.7 (Update to 5.1.7 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/checkout-com-unified-payments-api
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2959/

## Description

The Checkout.com Payment Gateway plugin for WordPress is vulnerable to unauthorized order modification in all versions up to, and including, 5.1.6. The public Flow payment-session AJAX action (cko_flow_create_payment_session) passes the browser's reference, metadata (including order_id) and line items to Checkout.com, and also the amount when the cart is empty. The card payment return handler (wc-api=wc_checkoutcom_callback) then acts on the order named in the payment's metadata without checking that the request is linked to that order. The Flow 3D Secure return (wc-api=wc_checkoutcom_flow_process) builds a new order from the payment's details when no order matches. This makes it possible for unauthenticated attackers to create a payment that names another customer's unpaid order, move that order to on-hold, and be redirected to its order-received URL, which carries the order key. Attackers can also create orders made up of line items and prices they choose.

## References

- https://wpsec.com/vuln/WPSEC-2026-2959/
- https://plugins.svn.wordpress.org/checkout-com-unified-payments-api/tags/5.1.7/
- https://wordpress.org/plugins/checkout-com-unified-payments-api/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2959/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.