EUVD-2026-50118
GHSA-hmc6-h7gx-qx8g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-accessible callback endpoint requires no auth or interaction; integrity is limited to order-data tampering with no confidentiality or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The PayU CommercePro Plugin WordPress plugin through 3.8.9 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders.
AnalysisAI
Order integrity bypass in the PayU CommercePro Plugin for WordPress (versions through 3.8.9) enables unauthenticated remote attackers to tamper with WooCommerce order totals, shipping details, and metadata without paying the correct amount. The plugin processes payment-gateway callbacks without verifying the cryptographic signature that PayU issues, meaning any HTTP client can forge a callback and manipulate arbitrary orders. A publicly available proof-of-concept exploit exists per WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.
Technical ContextAI
The PayU CommercePro Plugin integrates the PayU payment gateway with WooCommerce stores on WordPress. Payment gateways typically protect their server-to-server callback notifications (IPN/webhook) with an HMAC or platform-specific cryptographic signature, which the receiving plugin must validate before acting on the payload. CWE-862 (Missing Authorization) applies here: the plugin skips that signature verification step entirely, treating any inbound callback as legitimate. The affected CPE is cpe:2.3:a:unknown:payu_commercepro_plugin:*:*:*:*:*:*:*:* covering all versions up to and including 3.8.9. WooCommerce must be present as the underlying e-commerce layer since the vulnerability manifests in order-mutation logic exposed to PayU callback endpoints.
RemediationAI
No vendor-released patched version has been identified in the available data; the affected range listed by EUVD extends to the latest known release (3.8.9) with no fixed version confirmed. Store operators should immediately deactivate the PayU CommercePro Plugin until an updated version is released and verified. As a compensating control, restrict access to the plugin's payment callback endpoint at the web server or WAF layer to only PayU's documented IP ranges - this limits who can submit callbacks, though IP-based allowlisting can be bypassed if PayU's IP space is broad. Additionally, monitor WooCommerce orders for anomalous pricing discrepancies (orders with zero or near-zero totals processed as paid). The WPScan advisory at https://wpscan.com/vulnerability/e2dc15c7-2210-4be8-b7f3-55a9477e488d/ and NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-13692 should be monitored for patch availability. Disabling the plugin removes payment gateway functionality for PayU customers, so operators should weigh fraud exposure against revenue disruption.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today