Asaas Gateway EUVD-2026-100858

Exploitable against the plugin's DEFAULT configuration: the payment webhook accepts an empty access token and does not verify that the confirmed payment matches the order being marked paid, so no authentication or special setup is required for versions before 2.7.8. The only meaningful prerequisites are that the Asaas Gateway for WooCommerce plugin (pre-2.7.8) is installed, active, and reachable over the network with its default/unconfigured webhook token. Exploitation is LIMITED in effect to integrity of order payment status - it cannot exfiltrate data or take down the site - and real-world harm depends on whether the merchant auto-fulfills orders on 'paid' status; stores that have set a non-empty webhook access token may not be affected.

This is a moderate, business-logic authentication bypass rather than a system-compromise flaw. The CVSS vector (AV:N/AC:L/PR:N/UI:N, score 5.3) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, and the impact is scoped strictly to integrity (C:N/I:L/A:N) - attackers can falsely mark WooCommerce orders as paid, not read data or crash the server. Signals are largely consistent but point to limited urgency: EPSS is low (0.22%, 12th percentile) and SSVC lists Exploitation as 'none' (no observed active exploitation), yet SSVC also flags Automatable:yes and Technical Impact:partial, which aligns with the trivial default-config bypass. The vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation; however, publicly available exploit code (via WPScan) raises opportunistic risk. Net: this is a real, easily-triggered fraud/fulfillment-bypass issue for merchants using this specific plugin, but it is not a high-priority mass-exploitation threat - prioritize patching for affected e-commerce sites, especially those shipping goods automatically on 'paid' status.

An attacker identifies a WooCommerce store running the Asaas Gateway plugin in its default configuration and sends a crafted request to the plugin's payment webhook endpoint with an empty access token. Because the webhook neither validates the token nor confirms the payment belongs to the referenced order, the store marks the attacker's chosen order(s) as paid, enabling order fulfillment or digital-goods delivery without payment. Public exploit code for this flaw is available via WPScan.