Description

The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signature.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-04T10:17:13.457Z",
  "pubdate": "2026-09-04T10:17:13.457Z",
  "executiveSummary": "The ePayco Payment Gateway for WooCommerce plugin, specifically versions prior to 8.4.7, contains a critical authentication bypass vulnerability related to improper verification of payment confirmation requests.\nThe vulnerability type is classified as an improper authentication or verification failure, which allows an unauthenticated remote attacker to manipulate the order status lifecycle.\nThe impact of this flaw is significant, as it enables unauthorized modification of transaction states, effectively allowing attackers to mark orders as 'paid' without completing a legitimate financial transaction.\nThe affected system is the ePayco payment integration module within WordPress-based WooCommerce environments.\nRisk implications include direct financial loss, inventory depletion, and potential systemic fraud, as the integrity of the payment callback mechanism is entirely compromised.\nNo specific privileged access or pre-existing credentials are required to execute this attack; it is exploitable by an unauthenticated actor over the network.\nThe vulnerability originates from a failure to validate the cryptographically signed response from the payment provider, leaving the endpoint susceptible to arbitrary request injection.",
  "technicalDetails": "The vulnerability resides in the callback or webhook handling logic of the ePayco Payment Gateway for WooCommerce plugin. The core issue involves a lack of cryptographic signature verification or inconsistent validation of the callback request parameters sent by the payment gateway to the merchant's site.\nIn a secure payment integration, the merchant's server expects a signed payload from the payment provider. This payload typically includes a unique transaction identifier, payment status, and an HMAC or digital signature derived from a shared secret key. The plugin is expected to recalculate the signature based on the received data and the shared secret to ensure authenticity and integrity.\nIn the vulnerable versions (pre-8.4.7), the plugin fails to strictly enforce this check. Consequently, the application logic processes incoming POST requests to the gateway's notification endpoint without confirming that the data originated from the authorized ePayco infrastructure.\nThe attack flow proceeds as follows: First, the attacker identifies the URL endpoint responsible for processing payment callbacks within the WooCommerce environment. Second, the attacker crafts a malicious HTTP request that mimics the structure of an ePayco successful payment confirmation, ensuring that the payload contains the specific order ID they wish to manipulate.\nBecause the plugin does not verify the gateway's signature, it treats the unauthenticated, forged request as legitimate. The backend logic then triggers the WooCommerce function responsible for updating the order status to 'processing' or 'completed'.\nOnce the order status is updated to 'paid', the WordPress system proceeds with standard order fulfillment processes, such as granting access to digital downloads or triggering automated shipping workflows, despite no funds being transferred to the merchant's ePayco account.\nThis vulnerability is classified as critical because it is remotely exploitable without authentication. The attack surface is exposed directly through the WordPress REST API or standard plugin webhook endpoints. The exploit does not require specialized tools, only the ability to send standard HTTP POST requests to the publicly accessible callback URL. The post-exploitation impact allows for automated or manual mass fraud, leading to severe financial and operational disruption for affected e-commerce stores."
}