EUVD-2026-39709
GHSA-9p3j-8vjx-24pq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Network-reachable unauthenticated IDOR with no interaction needed; impact limited to partial integrity and availability, no confidentiality exposure confirmed.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Insecure Direct Object References (IDOR) in Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0 versions.
AnalysisAI
Unauthenticated IDOR in Payment Gateway Based Fees and Discounts for WooCommerce (versions up to and including 3.0.0) allows remote, unauthenticated attackers to manipulate payment gateway fee and discount object references, resulting in unauthorized modification of pricing logic and potential disruption of checkout availability. The CVSS vector (PR:N/UI:N/AV:N) confirms exploitation requires no authentication or user interaction, making this trivially reachable on any exposed WooCommerce storefront running the affected plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated entry point lowers the barrier for opportunistic abuse.
Technical ContextAI
The affected component is the 'Payment Gateway Based Fees and Discounts for WooCommerce' WordPress plugin (slug: checkout-fees-for-woocommerce), which extends WooCommerce to apply conditional surcharges or discounts based on the selected payment gateway at checkout. CWE-639 (Authorization Through User-Controlled Key) describes the root cause: the plugin uses a user-supplied identifier to reference fee or discount objects without verifying that the requesting party is authorized to act on that specific object. This is a classic IDOR pattern where server-side object lookups are driven by attacker-controlled input, bypassing access control. No CPE strings were included in the source data, but the affected scope is confined to WordPress installations running WooCommerce with this plugin installed at version 3.0.0 or earlier. The Patchstack advisory (referenced via NVD) is the authoritative source.
RemediationAI
No specific patched version number was confirmed in the available input data. Site operators should consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/checkout-fees-for-woocommerce/vulnerability/wordpress-payment-gateway-based-fees-and-discounts-for-woocommerce-plugin-3-0-0-insecure-direct-object-references-idor-vulnerability for the latest fix version and apply any available update from the WordPress plugin repository immediately. If a patched release is not yet available, the primary compensating control is to deactivate and remove the plugin until a fix is confirmed - deactivation removes the vulnerable checkout endpoint entirely, eliminating the attack surface at the cost of losing payment gateway fee/discount functionality. As a secondary measure, web application firewall rules can be applied to restrict unauthenticated POST requests to checkout-related endpoints, though this does not address the underlying authorization flaw. Restricting the WordPress admin panel to trusted IPs is a general hardening measure but does not mitigate this specific unauthenticated vector.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today