BitPay Gateway EUVD-2026-111969

The target site must run the BitPay Gateway for WooCommerce plugin version 4.1.3 or earlier with the BitPay payment method active, and the attacker must possess at least one genuine (even low-value) BitPay transaction to supply as the confirmation. No WordPress or site authentication is required (PR:N), and no user interaction is needed. Exploitation is limited to deployments actually using this specific BitPay gateway, and relies on the attacker being able to obtain a real BitPay transaction confirmation to reuse; impact is confined to falsely marking orders paid rather than site takeover or data access.

This is a business-logic payment-confirmation flaw in the BitPay Gateway for WooCommerce plugin (through 4.1.3): the plugin does not bind the payment provider's transaction confirmation to the specific order it completes, nor validate the confirmed amount, so an attacker holding one genuine low-value BitPay transaction can mark arbitrary higher-value orders as paid. Signals are modest and mostly consistent: CVSS 3.1 is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) - network-reachable, unauthenticated (PR:N), low complexity, integrity-only impact and no confidentiality or availability effect, which matches a fraud/order-manipulation weakness rather than code execution or data theft. The vuln.today decision label is 'this_month' (a moderate priority, not act_now/emergency). No EPSS score, no CISA KEV entry, and no SSVC decision data were supplied, so widespread or automated exploitation cannot be asserted from the inputs. A public PoC reference exists (the WPScan entry) but it is not verified as working exploit code, so POC availability must not be treated as active exploitation. Note a tag inconsistency: the input tags this as 'Information Disclosure', but the CVSS vector sets C:N and the mechanism is payment-status forgery (integrity), not disclosure - treat the 'Information Disclosure' label as inaccurate. Net: a real financial-fraud risk for merchants running this specific gateway, but a moderate-severity, product-specific issue rather than a mass-exploitation emergency.

An attacker legitimately completes one small genuine BitPay transaction, then reuses that confirmation against a merchant running the BitPay Gateway for WooCommerce plugin, pointing it at a different, higher-value order. Because the plugin neither ties the confirmation to the originating order nor checks the paid amount, the targeted order is marked paid and goods or services are released without real payment. A public PoC reference exists (WPScan) but is not verified as working exploit code.