Description

The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount, allowing unauthenticated attackers to mark arbitrary orders as paid without payment.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-22T06:16:15.383Z",
  "pubdate": "2026-08-22T06:16:15.383Z",
  "executiveSummary": "The Conekta Payment Gateway WordPress plugin before version 6.2.2 suffers from a critical architectural vulnerability involving the lack of cryptographic authenticity verification and state validation for incoming asynchronous webhook notifications.\nThis vulnerability is classified as an improper authentication and authorization flaw, allowing remote, unauthenticated threat actors to interact directly with the plugin's webhook endpoint over the network.\nThe primary business and system impact is the ability for malicious actors to arbitrarily manipulate order states within the WordPress database, successfully marking unpaid or arbitrary orders as fully paid without executing any legitimate financial transaction.\nThe risk implications are severe for merchants utilizing the affected software, as it exposes them to direct financial loss, inventory depletion, and fraudulent order fulfillment.\nNo special privileges or prior authentication are required to execute this exploit, and the attack can be mounted entirely via external network requests targeting the exposed webhook listener.\nMitigation requires upgrading the Conekta Payment Gateway plugin to version 6.2.2 or later, where proper validation mechanisms are implemented to ensure webhook authenticity, order binding, and amount verification.",
  "technicalDetails": "The vulnerability resides within the webhook processing component of the Conekta Payment Gateway WordPress plugin, specifically affecting versions prior to 6.2.2.\nThe root cause of the vulnerability stems from insufficient input validation and a complete absence of cryptographic signature verification or shared secret validation on incoming HTTP POST requests sent to the plugin's webhook handler.\nAdditionally, the affected endpoint fails to implement proper business logic controls, omitting critical checks that bind the payment confirmation payload to a specific, legitimate target order identifier and failing to cross-reference the confirmed payment amount with the actual order total.\nBecause the endpoint is exposed externally via standard WordPress routing mechanisms, it is accessible via the network to any unauthenticated user without requiring valid session tokens, API keys, or user credentials.\nThe attack flow proceeds as follows: an unauthenticated attacker identifies the public URL of the plugin's webhook notification endpoint. The attacker then constructs a malicious HTTP POST request mimicking a legitimate payment gateway notification payload generated by Conekta.\nWithin the crafted payload, the attacker specifies arbitrary order identifiers and status indicators, such as a successful payment confirmation flag, while omitting or falsifying transaction identifiers and monetary amounts.\nUpon receipt of the unauthenticated request, the vulnerable plugin code parses the incoming JSON or form-encoded payload without validating its provenance against Conekta's cryptographic signature headers.\nThe plugin subsequently executes database queries to locate the targeted order and updates its internal payment status to paid, circumventing the actual payment gateway verification loop entirely.\nPost-exploitation impact includes unauthorized state transition of arbitrary orders, granting attackers digital or physical goods, services, or downloadable content without financial exchange, leading to potential inventory corruption and direct revenue loss for the merchant."
}