Description

The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the order being marked as paid, nor does it verify the authenticity of its payment-completion request, allowing unauthenticated attackers to reuse a single valid transaction to mark arbitrary orders as paid and bypass payment.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-06T22:16:42.680Z",
  "pubdate": "2026-08-06T22:16:42.680Z",
  "executiveSummary": "An authorization and cryptographic verification flaw exists in the Integrate PhonePe with WooCommerce WordPress plugin through version 1.2.1. The vulnerability stems from a failure to properly validate transaction ownership and authenticity during payment completion callbacks. This security deficit enables unauthenticated malicious actors to intercept and repeatedly reuse a single legitimate payment transaction reference to mark arbitrary, high-value, or distinct orders as successfully paid within the e-commerce platform.\nThe primary impact of this flaw is complete payment bypass, leading to severe financial loss for merchants utilizing the vulnerable plugin. Attackers do not require prior authentication, elevated privileges, or interaction with the targeted store's administrative interfaces; they only require a single valid transaction ID that has previously interacted with the payment gateway. The attack relies solely on manipulating incoming HTTP requests directed at the plugin's payment processing endpoints, subverting the core business logic responsible for order status reconciliation.",
  "technicalDetails": "The root cause of this vulnerability lies in inadequate input validation and the absence of cryptographic integrity checks within the payment verification handler of the Integrate PhonePe with WooCommerce WordPress plugin. Specifically, the affected component fails to enforce a strict cryptographic binding between a verified payment transaction identifier and the specific WooCommerce order ID originally generated for that transaction. Furthermore, the endpoint lacks robust verification mechanisms to ensure that a payment-completion request originates from an authentic, trusted server-to-server callback rather than a maliciously crafted external request.\nThe exploitation flow proceeds as follows: An attacker initiates a legitimate transaction through the payment gateway to obtain a valid, successful transaction reference string. Once this valid transaction is confirmed, the attacker targets an arbitrary, unpaid order within the WooCommerce installation. By constructing an unauthenticated HTTP request directed at the plugin's payment processing callback or endpoint, the attacker supplies the previously obtained valid transaction reference alongside the identifier of the targeted, unrelated order. Because the vulnerable component does not verify whether the transaction hash corresponds to the requested order ID, nor validates the authenticity and replay status of the incoming payload, the application processes the request as valid. The plugin subsequently updates the arbitrary order's status to paid, allowing the attacker to acquire goods or services without rendering payment.\nThe vulnerability affects the Integrate PhonePe with WooCommerce WordPress plugin for all versions up to and including 1.2.1. The attack vector is fully network-exposed via the plugin's publicly accessible web endpoints handling payment notifications or returns. No privileges or authentication are required to execute the exploit, rendering any e-commerce site utilizing the unpatched plugin directly vulnerable to systemic financial fraud."
}