EUVD-2026-51723
GHSA-cp6p-3j8j-57c9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
PR:N confirmed by unauthenticated nopriv AJAX handlers; I:H reflects ability to forge payment completion states enabling fulfillment fraud, exceeding the partial-impact threshold of I:L.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Direct Payments for WooCommerce WordPress plugin before 2.5.3 does not verify that the requester owns the targeted WooCommerce order in several unauthenticated AJAX handlers before changing its status and overwriting its payment metadata, allowing unauthenticated attackers to tamper with other customers' orders, including forging a "payment sent" state, overwriting the payment-method label, and attaching forged payment-proof files.
AnalysisAI
Unauthenticated order manipulation in the Direct Payments for WooCommerce WordPress plugin before 2.5.3 enables any remote attacker to forge payment completion states, overwrite payment-method labels, and attach fabricated proof-of-payment files to arbitrary customer orders. The flaw stems from multiple AJAX handlers that process order updates without verifying the requester owns or is otherwise authorized to modify the targeted order. A publicly available proof-of-concept exists and the SSVC framework rates this as automatable, meaningfully amplifying the fraud risk for affected merchants despite the EPSS score of 0.15% (4th percentile).
Technical ContextAI
The vulnerability affects the Direct Payments for WooCommerce WordPress plugin, identified by CPE cpe:2.3:a:unknown:direct_payments_for_woocommerce:*:*:*:*:*:*:*:* across all versions prior to 2.5.3. WordPress plugins can register AJAX handlers accessible to unauthenticated HTTP clients via wp-admin/admin-ajax.php using nopriv hooks. The plugin exposes several such handlers for updating order status and payment metadata but omits an object-level authorization check, failing to verify that the caller owns the WooCommerce order ID supplied in the request. Because WooCommerce order IDs are sequential integers, enumeration is trivial. This maps directly to CWE-284 (Improper Access Control), specifically an Insecure Direct Object Reference (IDOR) pattern at the AJAX handler boundary where identity is unauthenticated and ownership is never validated.
RemediationAI
The primary fix is upgrading the Direct Payments for WooCommerce plugin to version 2.5.3 or later, which introduces the missing authorization checks in the previously unprotected AJAX handlers; this update should be applied immediately via the WordPress plugin dashboard or via WP-CLI using 'wp plugin update'. If immediate patching is not feasible, a compensating control is to restrict unauthenticated access to wp-admin/admin-ajax.php at the web server or WAF layer - however, this carries a meaningful side effect: other plugins legitimately relying on nopriv AJAX actions may break, so this must be tested in a staging environment before production deployment. Disabling the plugin entirely eliminates the attack surface completely at the cost of losing direct-payment functionality. Merchants should also audit recent WooCommerce orders for anomalous status transitions (e.g., unexpected 'payment sent' states) and mismatched payment-method labels to identify potential prior exploitation. The authoritative WPScan advisory is at https://wpscan.com/vulnerability/b2b7f90e-359f-4fb4-9b48-c87ecb229f76/.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today