Auth bypass in Ipaymu Payment Gateway For Woocommerce
CVE-2026-0656
The iPaymu Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 2.0.2 via the 'check_ipaymu_response' function. This is due to the plugin not validating webhook request authenticity through signature verification or origin checks. This makes it possible for unauthenticated attackers to mark WooCommerce orders as paid by sending crafted POST requests to the webhook endpoint without any payment occurring, as well as enumerate order IDs and obtain valid order keys via GET requests, exposing customer order PII including names, addresses, and purchased products.
Vulnerability class: Broken Access Control
EPSS: 0.003 (22.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N.
Affected products
- Ipaymu Payment Gateway For Woocommerce — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-0656?
- CVE-2026-0656 is a high-severity vulnerability in Ipaymu Payment Gateway For Woocommerce, classified under Missing Authorization. CVSS score: 8.2/10. Published 2026-01-07.
- How severe is CVE-2026-0656?
- High severity. CVSS v3 base score is 8.2 out of 10.