# Revolut Gateway for WooCommerce <= 4.22.12 - Unauthenticated Payment Amount Validation Bypass via Currency Mismatch

- **ID:** WPSEC-2026-3129
- **Plugin:** Revolut Gateway for WooCommerce (`revolut-gateway-for-woocommerce`), https://wordpress.org/plugins/revolut-gateway-for-woocommerce/
- **Affected versions:** all versions before 4.22.13
- **Fixed in:** 4.22.13 (Update to 4.22.13 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/revolut-gateway-for-woocommerce
- **Fix released:** 2026-11-13
- **Published:** 2026-11-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3129/

## Description

The Revolut Gateway for WooCommerce plugin for WordPress is vulnerable to a payment validation bypass via the order total verification in all versions up to, and including, 4.22.12, due to the verify_order_total() check accepting a Revolut payment whose currency differs from the WooCommerce order currency whenever the two amounts, in minor units, are within the small rounding tolerance. This makes it possible for unauthenticated attackers placing an order to have it marked as paid with a payment in a lower-valued currency. This requires the store to let customers switch the checkout currency, for example through a multi-currency plugin.

## References

- https://wpsec.com/vuln/WPSEC-2026-3129/
- https://plugins.svn.wordpress.org/revolut-gateway-for-woocommerce/tags/4.22.13/
- https://wordpress.org/plugins/revolut-gateway-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3129/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.