CVE-2026-0656: iPaymu WooCommerce Auth Bypass Flaw

CVE-2026-0656 Overview

The iPaymu Payment Gateway for WooCommerce plugin for WordPress contains a critical Missing Authentication vulnerability (CWE-862) in all versions up to and including 2.0.2. The vulnerability exists in the check_ipaymu_response function, which fails to validate webhook request authenticity through signature verification or origin checks. This security flaw allows unauthenticated attackers to manipulate WooCommerce order statuses, enumerate order IDs, and access sensitive customer information without any legitimate payment occurring.

Critical Impact

Unauthenticated attackers can mark WooCommerce orders as paid without actual payment, enumerate order IDs, obtain valid order keys, and expose customer PII including names, addresses, and purchased products.

Affected Products

• iPaymu Payment Gateway for WooCommerce plugin versions up to and including 2.0.2
• WordPress installations with vulnerable iPaymu plugin versions
• WooCommerce stores utilizing iPaymu payment gateway integration

Discovery Timeline

• 2026-01-07 - CVE CVE-2026-0656 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2026-0656

Vulnerability Analysis

This vulnerability stems from a fundamental authentication bypass in the payment gateway's webhook handling mechanism. The check_ipaymu_response function processes incoming webhook requests without verifying the legitimacy of the request source or validating any cryptographic signatures. In payment gateway integrations, webhooks serve as critical callbacks that notify the e-commerce platform when payment events occur. Without proper authentication, these endpoints become prime targets for exploitation.

The vulnerable code path allows attackers to craft POST requests that mimic legitimate payment confirmation webhooks from the iPaymu payment service. When the plugin receives these forged requests, it incorrectly processes them as valid payment confirmations, updating order statuses to "paid" without any actual transaction taking place. Additionally, the endpoint's GET request handling exposes order enumeration capabilities, allowing attackers to discover valid order IDs and their associated order keys.

Root Cause

The root cause is the complete absence of webhook request validation in the check_ipaymu_response function. Secure payment gateway implementations typically employ multiple layers of verification including HMAC signature validation, IP address allowlisting, shared secret verification, or timestamp-based request freshness checks. The affected plugin implements none of these security controls, trusting all incoming requests to the webhook endpoint implicitly. This represents a critical violation of the principle of "never trust user input" and fails to implement proper authorization controls as defined by CWE-862 (Missing Authorization).

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying WordPress installations running the vulnerable iPaymu plugin through fingerprinting techniques
2. Locating the webhook endpoint URL typically following WooCommerce payment gateway conventions
3. Sending crafted GET requests to enumerate existing order IDs and extract valid order keys
4. Submitting forged POST requests that simulate successful payment callbacks
5. Observing orders transition to "paid" status, enabling order fulfillment fraud

The vulnerability is particularly severe because it combines payment fraud capabilities with information disclosure. Attackers can not only manipulate payment statuses but also extract customer personally identifiable information (PII) including names, shipping addresses, and product purchase history through order enumeration. For detailed technical analysis, refer to the WordPress Plugin Code Review.

Detection Methods for CVE-2026-0656

Indicators of Compromise

• Unusual POST requests to WooCommerce payment webhook endpoints from unexpected IP addresses or geographic regions
• Orders marked as "paid" or "completed" without corresponding payment processor transaction records
• High volume of GET requests to payment callback URLs indicating order enumeration attempts
• Discrepancies between payment gateway dashboard records and WooCommerce order payment statuses
• Customer reports of receiving order confirmations or shipments for unpaid orders

Detection Strategies

• Implement web application firewall (WAF) rules to monitor and log all requests to payment webhook endpoints
• Configure WooCommerce order status change logging to create an audit trail of payment state transitions
• Deploy anomaly detection to identify orders changing to paid status without matching gateway transaction IDs
• Enable SentinelOne Singularity XDR to correlate web server logs with endpoint telemetry for comprehensive threat visibility
• Regularly reconcile WooCommerce orders against iPaymu payment gateway transaction reports

Monitoring Recommendations

• Enable verbose logging on WordPress and WooCommerce to capture detailed request information for webhook endpoints
• Set up real-time alerting for orders transitioning to paid status to enable rapid manual verification
• Monitor for sequential order ID access patterns that indicate automated enumeration activity
• Review access logs for requests to /wc-api/ endpoints from unusual user agents or IP ranges
• Implement SentinelOne's application control features to monitor WordPress plugin behavior

How to Mitigate CVE-2026-0656

Immediate Actions Required

• Update the iPaymu Payment Gateway for WooCommerce plugin to a patched version immediately
• Audit all WooCommerce orders from the past 90 days to identify any potentially fraudulent payment status changes
• Temporarily disable the iPaymu payment gateway if an update is not immediately available
• Review server access logs for suspicious webhook activity patterns
• Notify affected customers if PII exposure is confirmed through order enumeration

Patch Information

A security update addressing this vulnerability has been released. Review the WordPress Plugin Change Log for the latest patched version details. The fix implements proper webhook signature verification and origin validation in the check_ipaymu_response function. Organizations should update through the WordPress admin dashboard or by downloading the latest version from the WordPress plugin repository. For comprehensive vulnerability intelligence, consult the Wordfence Vulnerability Report.

Workarounds

• Implement server-level IP allowlisting to restrict webhook endpoint access to known iPaymu server IP addresses
• Deploy a web application firewall (WAF) rule to validate request signatures or block unsigned webhook requests
• Add custom PHP code to validate webhook requests against a shared secret before processing order updates
• Configure server access controls to require additional authentication headers for webhook endpoints
• Consider temporarily switching to an alternative payment gateway until the vulnerability is patched

# Example: Apache .htaccess IP restriction for webhook endpoint
# Add to WordPress root .htaccess file
<Files "index.php">
  <If "%{QUERY_STRING} =~ /wc-api=ipaymu/">
    Require ip 103.x.x.x
    # Replace with actual iPaymu server IP ranges
  </If>
</Files>