CVE-2026-0656: iPaymu WooCommerce Auth Bypass Vulnerability

CVE-2026-0656 Overview

CVE-2026-0656 affects the iPaymu Payment Gateway for WooCommerce plugin for WordPress in all versions up to and including 2.0.2. The vulnerability resides in the check_ipaymu_response function, which processes webhook callbacks without validating request authenticity. The plugin does not verify webhook signatures or check request origin, exposing the payment confirmation flow to unauthenticated abuse. Attackers can mark WooCommerce orders as paid without any actual payment, and enumerate order IDs to retrieve valid order keys that disclose customer personally identifiable information (PII). This issue is categorized under CWE-862: Missing Authorization.

Critical Impact
Unauthenticated attackers can forge payment confirmations and harvest customer PII including names, addresses, and order contents from affected WooCommerce stores.

Affected Products

iPaymu Payment Gateway for WooCommerce plugin for WordPress
All versions up to and including 2.0.2
WordPress sites running WooCommerce with the iPaymu gateway enabled

Discovery Timeline

2026-01-07 - CVE-2026-0656 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-0656

Vulnerability Analysis

The iPaymu Payment Gateway plugin exposes a webhook endpoint handled by the check_ipaymu_response function. This function processes incoming POST requests that the payment processor would normally send to confirm transactions. The function does not validate that incoming requests originate from iPaymu and does not verify any cryptographic signature on the payload.

An attacker who knows or guesses a valid WooCommerce order ID can submit a crafted POST request to the webhook endpoint. The plugin accepts the request and transitions the order status to paid. The merchant then fulfills the order without receiving any funds.

The same endpoint also responds to GET requests with order details when supplied with valid order identifiers. Because order IDs are sequential, attackers can enumerate them and extract order keys. Each order key unlocks customer data including names, billing and shipping addresses, and the list of purchased products.

Root Cause

The root cause is missing authorization on a webhook endpoint that performs a state-changing action. The plugin treats inbound webhook traffic as trusted without applying signature verification, shared-secret validation, or origin checks against iPaymu's published infrastructure. Sensitive read operations on the same handler also lack access control.

Attack Vector

The vulnerability is exploitable remotely over the network with no authentication and no user interaction. An attacker only needs the target store's URL and the ability to issue HTTP requests. Order ID enumeration is trivial because WooCommerce assigns incremental integer IDs by default. See the WordPress Plugin Code Review and Wordfence Vulnerability Analysis for the affected code paths.

Detection Methods for CVE-2026-0656

Indicators of Compromise

WooCommerce orders transitioning to processing or completed status without a matching transaction record in the iPaymu merchant dashboard.
HTTP POST requests to the iPaymu webhook callback URL originating from IP addresses outside iPaymu's documented payment infrastructure.
Bursts of sequential GET requests against the plugin's response handler enumerating order IDs.
Customer reports of shipped orders that were never paid for, or unexpected access to order confirmation pages.

Detection Strategies

Reconcile WooCommerce order status changes against authoritative iPaymu transaction logs on a daily basis.
Inspect web server access logs for unusual volumes of requests targeting the iPaymu gateway endpoint, particularly those iterating order ID parameters.
Alert on order status changes that occur without a corresponding authenticated admin session or genuine payment processor callback.

Monitoring Recommendations

Forward WordPress, WooCommerce, and web server logs to a centralized analytics platform for correlation across order events and HTTP traffic.
Build dashboards that track paid-but-unreconciled orders and surface anomalies in real time.
Monitor outbound shipping and fulfillment workflows for orders that lack a verified payment record.

How to Mitigate CVE-2026-0656

Immediate Actions Required

Disable or deactivate the iPaymu Payment Gateway for WooCommerce plugin until a patched release is installed and verified.
Review all WooCommerce orders processed while versions up to 2.0.2 were active and reconcile each against iPaymu's transaction records.
Restrict access to the webhook endpoint at the web server or WAF layer to iPaymu's documented source IP ranges.
Rotate any API keys or shared secrets associated with the iPaymu integration after patching.

Patch Information

A fix is reflected in the plugin's source control history. Review the WordPress Plugin Changeset Details and upgrade to the latest released version that includes webhook signature verification. Validate post-upgrade that check_ipaymu_response rejects unsigned or malformed callbacks.

Workarounds

Block public access to the iPaymu webhook URL using a web application firewall and allowlist only iPaymu's payment processor IP ranges.
Configure WooCommerce to require manual order review before fulfillment while the plugin remains unpatched.
Temporarily switch to an alternative payment gateway with verified signature-based webhook validation.

bash

# Example nginx allowlist restricting the iPaymu webhook endpoint
location ~* /\?wc-api=WC_Gateway_Ipaymu {
    allow <iPaymu_IP_range>;
    deny all;
    proxy_pass http://wordpress_backend;
}