Description

The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect that request to an arbitrary host (disclosing the merchant's payment-gateway credentials) and to forge a success response that marks arbitrary WooCommerce orders as paid.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-29T06:17:05.583Z",
  "pubdate": "2026-08-29T06:17:05.583Z",
  "executiveSummary": "The Total processing card payments for WooCommerce WordPress plugin, in versions through 7.3, contains a critical vulnerability involving Server-Side Request Forgery (SSRF) and insufficient verification of payment gateway responses.\nThe flaw allows unauthenticated remote attackers to manipulate the plugin into performing unauthorized HTTP requests to arbitrary destinations. By controlling the target host, an attacker can exfiltrate sensitive payment-gateway credentials stored by the merchant.\nFurthermore, the lack of authenticity checks on the responses received from these requests enables attackers to spoof successful transaction notifications. This allows the unauthorized marking of WooCommerce orders as 'paid' without actual payment completion.\nThis vulnerability presents a severe risk to financial integrity and data security. The exploit requires no authentication, granting any external attacker the ability to bypass payment processing logic and commit fraudulent activities. Immediate mitigation is required to prevent financial loss and the compromise of sensitive merchant data.",
  "technicalDetails": "The vulnerability originates from a failure to validate user-supplied path data before the plugin constructs and executes server-side verification requests. This improper input sanitization occurs within the payment verification logic of the Total processing card payments for WooCommerce plugin.\nThe attack flow begins when an unauthenticated actor submits a crafted request to the plugin's verification endpoint. Because the plugin does not implement an allowlist or strict validation for the destination URL, it utilizes user-controlled input to assemble the request URI. This triggers an SSRF condition where the WordPress server acts as a proxy, sending requests to an arbitrary domain or internal IP address specified by the attacker.\nBy redirecting these requests to an attacker-controlled server, the merchant's payment-gateway credentials—often transmitted as part of the verification handshake—are leaked to the attacker, leading to a complete compromise of the payment integration.\nConcurrently, the vulnerability is exacerbated by the absence of cryptographic verification or signature validation on the responses received from the payment gateway. The plugin assumes that any response returned from the requested endpoint is legitimate. Consequently, an attacker can configure a malicious host to return a 'success' status message, which the plugin then parses. Upon receiving this forged response, the plugin updates the WooCommerce order database to reflect a successful payment status.\nThe exploitation path is straightforward: 1) The attacker probes the vulnerable endpoint to determine the exact structure of the verification request. 2) The attacker submits a manipulated request URI to the vulnerable component. 3) The server-side code performs an outward-facing request to the attacker's infrastructure, allowing for credential theft. 4) The attacker sends a crafted 'success' payload back to the plugin. 5) The plugin updates the order status to 'paid', completing the fraudulent transaction flow without legitimate financial settlement.\nThis issue affects all versions through 7.3 and is exploitable over the network without any requirement for administrative privileges or user authentication."
}