CVE-2026-0656
Published: 07 January 2026
Description
The iPaymu Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 2.0.2 via the 'check_ipaymu_response' function. This is due to the plugin not validating webhook request authenticity through signature verification…
more
or origin checks. This makes it possible for unauthenticated attackers to mark WooCommerce orders as paid by sending crafted POST requests to the webhook endpoint without any payment occurring, as well as enumerate order IDs and obtain valid order keys via GET requests, exposing customer order PII including names, addresses, and purchased products.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by requiring timely patching of the iPaymu plugin to versions beyond 2.0.2 that include proper webhook authentication via signature verification or origin checks.
Requires validation of webhook request inputs for authenticity through signatures or origins, preventing crafted POST requests from marking orders as paid and GET requests from enumerating order IDs.
Enforces approved access authorizations on the vulnerable check_ipaymu_response function, blocking unauthenticated remote exploitation of order processing and PII exposure.
Security SummaryAI
CVE-2026-0656, published on 2026-01-07, is a missing authentication vulnerability (CWE-862) in the iPaymu Payment Gateway for WooCommerce plugin for WordPress, affecting all versions up to and including 2.0.2. The flaw exists in the 'check_ipaymu_response' function, which does not properly validate incoming webhook requests through signature verification or origin checks, allowing unauthorized access to sensitive order processing functionality.
Unauthenticated attackers can exploit this vulnerability remotely with low attack complexity and no user interaction or privileges required (CVSSv3.1 Base Score: 8.2; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). Exploitation involves sending crafted POST requests to the webhook endpoint to falsely mark WooCommerce orders as paid without any actual payment occurring. Attackers can also use GET requests to enumerate order IDs and obtain valid order keys, resulting in exposure of customer personally identifiable information, including names, addresses, and details of purchased products.
Mitigation details are available in advisories such as the Wordfence threat intelligence report and WordPress plugin trac references, which highlight the vulnerable code in gateway.php (lines 316-336 and 370-380) and a relevant changeset at revision 3429657, indicating a patch has been applied in subsequent versions. Security practitioners should update the iPaymu Payment Gateway for WooCommerce plugin beyond version 2.0.2 to address this issue.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication in public-facing WordPress plugin webhook enables unauthenticated remote exploitation for order status manipulation and PII disclosure, directly mapping to T1190: Exploit Public-Facing Application.