What is the CVSS score of CVE-2026-0692?

CVE-2026-0692 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-0692?

Organizations using the BlueSnap Payment Gateway plugin for WooCommerce face unauthorized payment processing and financial fraud risk due to an authentication bypass vulnerability.

How to fix or mitigate CVE-2026-0692?

Within 24 hours: disable the BlueSnap plugin or restrict IPN endpoint access via Web Application Firewall rules blocking spoofed IP headers. Within 7 days: evaluate alternative payment gateways and plan migration if business continuity permits. Within 30 days: implement compensating controls (network segmentation, strict header validation) and monitor for suspicious IPN activity; reassess when vendor patch becomes available.

WordPress CVE-2026-0692

HIGH

Missing Authorization (CWE-862)

2026-02-14 security@wordfence.com

WordPress Authentication Bypass

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

CVE Published

Feb 14, 2026 - 05:16 nvd

HIGH 7.5

DescriptionCVE.org

The BlueSnap Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.3.0. This is due to the plugin relying on WooCommerce's WC_Geolocation::get_ip_address() function to validate IPN requests, which trusts user-controllable headers like X-Real-IP and X-Forwarded-For to determine the client IP address. This makes it possible for unauthenticated attackers to bypass IP allowlist restrictions by spoofing a whitelisted BlueSnap IP address and send forged IPN (Instant Payment Notification) data to manipulate order statuses (mark orders as paid, failed, refunded, or on-hold) without proper authorization.

AnalysisAI

Unauthenticated attackers can forge IPN payment notifications in the BlueSnap Payment Gateway for WooCommerce plugin by spoofing whitelisted IP addresses through header manipulation, allowing them to arbitrarily modify order statuses without authorization. The vulnerability stems from improper IP validation in all versions up to 3.3.0, affecting WordPress installations with this payment plugin active. No patch is currently available.

Technical ContextAI

This vulnerability (CWE-862: Missing Authorization) affects BlueSnap Payment Gateway for WooCommerce (WordPress plugin). The BlueSnap Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.3.0. This is due to the plugin relying on WooCommerce's WC_Geolocation::get_ip_address() function to validate IPN requests, which trusts user-controllable headers like X-Real-IP and X-Forwarded-For to determine the client IP address. This makes it possible for unauthenticated attackers to bypass IP allowlist restrictions by spoofing a whitelisted Blue