Description

Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-11T19:17:42.133Z",
  "pubdate": "2026-09-11T19:17:42.133Z",
  "executiveSummary": "The Deposits and Partial Payments for WooCommerce plugin, specifically versions 3.1.0 and below, contains a critical security vulnerability involving unauthenticated broken access control.\nThis flaw allows unauthorized, unauthenticated attackers to manipulate, view, or interact with deposit and partial payment data that should be restricted to administrative or authorized users.\nThe vulnerability stems from improper validation of user permissions during the handling of deposit-related requests, failing to enforce mandatory authentication checks on sensitive endpoints.\nThe impact is significant, potentially leading to unauthorized data exposure, manipulation of order statuses, or modification of payment configurations, which can compromise the financial integrity and privacy of the affected WooCommerce store.\nNo user interaction is required for a remote, unauthenticated attacker to exploit this vulnerability, placing it at a high risk level for store operators utilizing the affected versions.\nThe primary security implication is the total breakdown of access control mechanisms within the plugin's core functions, enabling attackers to bypass intended security boundaries.",
  "technicalDetails": "The vulnerability is characterized as an Insecure Direct Object Reference (IDOR) or a general broken access control issue resulting from the absence of capability checks within the plugin's request handling logic.\nIn the affected versions (<= 3.1.0), the plugin fails to implement proper authorization checks within the functions responsible for processing, retrieving, or updating deposit and partial payment information.\nThe vulnerable component involves the plugin’s request handlers, which process incoming HTTP requests directed at deposit-specific functionality. By failing to verify if the requester possesses 'manage_woocommerce' or 'edit_shop_orders' capabilities, the plugin processes requests from any remote, unauthenticated attacker.\nThe attack flow begins when an attacker sends a crafted HTTP request (GET or POST) directly to the vulnerable endpoints associated with Deposits and Partial Payments for WooCommerce. Because the plugin does not validate the session or the user role before executing these functions, the server processes the request as if it originated from an authorized user.\nFor instance, an attacker could enumerate order IDs or deposit identifiers to retrieve details regarding payment plans, customer information, or pending partial payments. Furthermore, if the request handler permits update actions, an attacker could modify the state of a payment plan, potentially forcing an order to an 'incorrectly paid' or 'completed' status without proper funds being captured.\nThe root cause is the lack of a proper authorization layer, such as checking 'current_user_can()' or verifying nonces for sensitive administrative or data-altering operations. Consequently, the plugin blindly executes logic that it assumes is protected by the host CMS, but which is explicitly exposed via direct access paths.\nThe post-exploitation impact includes the potential for attackers to gain unauthorized insight into store financial data, manipulation of transaction flows, and in some scenarios, the ability to facilitate fraudulent payment outcomes or bypass payment gateway verifications, depending on how the plugin integrates with the broader WooCommerce environment."
}