Auth bypass in Ipaymu Payment Gateway For Woocommerce

CVE-2026-0656

The iPaymu Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 2.0.2 via the 'check_ipaymu_response' function. This is due to the plugin not validating webhook request authenticity through signature verification or origin checks. This makes it possible for unauthenticated attackers to mark WooCommerce orders as paid by sending crafted POST requests to the webhook endpoint without any payment occurring, as well as enumerate order IDs and obtain valid order keys via GET requests, exposing customer order PII including names, addresses, and purchased products.

Vulnerability class: Broken Access Control

EPSS: 0.003 (22.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N.

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-0656?
CVE-2026-0656 is a high-severity vulnerability in Ipaymu Payment Gateway For Woocommerce, classified under Missing Authorization. CVSS score: 8.2/10. Published 2026-01-07.
How severe is CVE-2026-0656?
High severity. CVSS v3 base score is 8.2 out of 10.