Description

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel or fail them.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-11T11:16:55.077Z",
  "pubdate": "2026-09-11T11:16:55.077Z",
  "executiveSummary": "The Payment Gateway PayPay for WooCommerce WordPress plugin (versions 0.5 to 0.9.3) contains a critical authentication vulnerability regarding payment notification processing.\nThe vulnerability is classified as an Improper Authentication issue, where the plugin fails to verify the authenticity and integrity of incoming webhook notifications before processing state transitions for orders.\nBy manipulating notification requests, unauthenticated remote attackers can arbitrarily modify the payment status of orders within the WooCommerce store.\nThis impact includes the unauthorized marking of orders as 'paid', or causing legitimate orders to be cancelled or set to a failed state, potentially leading to financial loss, unauthorized delivery of goods, or service disruption.\nExploitation requires the attacker to possess knowledge of the store's merchant identifier, which is often discoverable through public-facing transaction artifacts.\nThe risk is severe as it allows direct manipulation of order processing workflows without any required user interaction or prior authentication.",
  "technicalDetails": "The vulnerability resides in the notification processing logic of the Payment Gateway PayPay for WooCommerce plugin, specifically within the endpoint responsible for handling incoming payment callbacks from the PayPay platform.\nThe root cause is a failure to implement server-side verification of payment notifications. Standard payment gateway integrations typically require the plugin to perform a handshake, signature verification, or an asynchronous server-to-server request back to the payment provider to validate that a notification is genuine and originates from the authorized gateway.\nIn this specific implementation, the plugin accepts HTTP POST requests containing payment update payloads without validating the cryptographic signature or checking the source IP address against known PayPay infrastructure.\nThe attack flow proceeds as follows: An unauthenticated attacker identifies the target store's merchant identifier. The attacker then constructs a crafted HTTP request that mimics the structure of a legitimate PayPay status update. Because the plugin lacks authentication headers or shared secret validation, it parses the payload and directly maps the request parameters—such as the order ID and status code—to internal WooCommerce order state-change functions.\nBy injecting specific parameters into these notifications, an attacker can influence the 'wc-processing', 'wc-completed', 'wc-cancelled', or 'wc-failed' states of any order within the WooCommerce database.\nThe vulnerability is present in versions 0.5 through 0.9.3. The lack of validation means the application blindly trusts user-supplied data provided via the POST body as truth, ignoring the security implications of unauthenticated state transitions in an e-commerce environment.\nSuccessful exploitation results in unauthorized modification of financial records, circumventing the intended payment flow of the WooCommerce store. Post-exploitation, attackers can trigger the 'payment received' logic of the plugin to trick the store management system into treating unpaid or fraudulent transactions as successfully processed, leading to inventory loss or premature shipping of products."
}