CVE-2026-0692: BlueSnap WooCommerce Auth Bypass Flaw

CVE-2026-0692 Overview

CVE-2026-0692 is a Missing Authorization vulnerability [CWE-862] affecting the BlueSnap Payment Gateway for WooCommerce plugin for WordPress in all versions up to and including 3.4.0. The plugin validates Instant Payment Notification (IPN) requests using WooCommerce's WC_Geolocation::get_ip_address() function, which trusts user-controllable HTTP headers such as X-Real-IP and X-Forwarded-For. Unauthenticated attackers can spoof a whitelisted BlueSnap IP address by injecting these headers, bypassing the IP allowlist. Successful exploitation enables attackers to forge IPN data and manipulate WooCommerce order statuses, marking orders as paid, failed, refunded, or on-hold without authorization.

Critical Impact
Unauthenticated attackers can forge payment notifications to mark unpaid orders as paid, causing direct financial loss to merchants running affected WooCommerce stores.

Affected Products

BlueSnap Payment Gateway for WooCommerce plugin for WordPress
All versions up to and including 3.4.0
WordPress installations using the plugin behind reverse proxies or load balancers

Discovery Timeline

2026-02-14 - CVE-2026-0692 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-0692

Vulnerability Analysis

The BlueSnap plugin restricts access to its IPN webhook endpoint by comparing the incoming client IP address against a hardcoded BlueSnap IP allowlist. To determine the client IP, the plugin calls WooCommerce's WC_Geolocation::get_ip_address() function inside class-wc-bluesnap-ipn-webhooks.php at line 417. This helper function inspects HTTP headers including X-Real-IP, X-Forwarded-For, and HTTP_CLIENT_IP before falling back to REMOTE_ADDR. Because these headers are attacker-controlled in any direct request, the allowlist provides no real authentication.

The plugin treats successful IP validation as sufficient authorization for processing payment notifications. No cryptographic signature verification, shared secret, or callback to BlueSnap's API is performed to confirm the authenticity of the IPN payload. As a result, an attacker who knows the format of an IPN request can drive arbitrary order state transitions.

Root Cause

The root cause is reliance on client-supplied HTTP headers for security-critical IP validation. Headers like X-Forwarded-For are intended for reverse proxy environments where a trusted upstream sets them, not for use as an authentication primitive on untrusted public endpoints.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP POST request to the plugin's IPN webhook endpoint. The request includes an X-Forwarded-For or X-Real-IP header set to a known BlueSnap IP address. The plugin parses the spoofed header, treats the request as legitimate, and processes the forged IPN body to update WooCommerce order status. No credentials, user interaction, or prior access are required.

The vulnerability mechanism is described in detail in the Wordfence Vulnerability Analysis and the affected source code can be reviewed in the WordPress Plugin Code Review.

Detection Methods for CVE-2026-0692

Indicators of Compromise

Unexpected WooCommerce order status transitions (paid, failed, refunded, on-hold) without corresponding gateway activity in BlueSnap's merchant portal.
HTTP requests to the BlueSnap IPN webhook endpoint containing X-Forwarded-For or X-Real-IP headers from source IPs that do not match the header value.
Anomalous POST requests to /wc-api/ BlueSnap webhook routes originating from non-BlueSnap autonomous systems.

Detection Strategies

Inspect web server access logs for requests where the connecting source IP (REMOTE_ADDR) differs from the value supplied in X-Forwarded-For or X-Real-IP on BlueSnap IPN endpoints.
Reconcile WooCommerce order status changes against authoritative BlueSnap transaction records on a scheduled basis.
Deploy WAF rules to log and alert on inbound traffic carrying BlueSnap-owned IPs in forwarding headers from external networks.

Monitoring Recommendations

Enable verbose logging on the BlueSnap IPN webhook endpoint to capture full request headers and bodies.
Alert on bursts of order status updates outside normal merchant activity windows.
Correlate WordPress audit logs with payment gateway transaction reports to identify unmatched state changes.

How to Mitigate CVE-2026-0692

Immediate Actions Required

Update the BlueSnap Payment Gateway for WooCommerce plugin to a version later than 3.4.0 once a patched release is available from the vendor.
Restrict access to the BlueSnap IPN webhook endpoint at the web server or WAF layer to known BlueSnap source IP ranges using the true connecting IP (REMOTE_ADDR), not forwarded headers.
Audit recent WooCommerce orders for unauthorized status changes and reconcile against BlueSnap merchant records.

Patch Information

At the time of publication, the vulnerability affects all plugin versions up to and including 3.4.0. Administrators should monitor the WordPress plugin repository for an updated release that validates IPN authenticity using a signature or server-side callback rather than header-based IP checks.

Workarounds

Configure the upstream reverse proxy or load balancer to strip incoming X-Forwarded-For and X-Real-IP headers from external clients before they reach WordPress.
Apply web server access controls (for example, nginxallow/deny directives or Apache Require ip) that filter the IPN endpoint based on the true TCP source address.
Temporarily disable the BlueSnap plugin if active payment processing is not required until a patched version is released.

bash

# Example nginx configuration restricting the BlueSnap IPN endpoint by true source IP
location ~ ^/wc-api/wc_gateway_bluesnap {
    # Replace with current BlueSnap IP ranges from vendor documentation
    allow 209.128.0.0/16;
    deny all;

    # Strip attacker-controlled forwarding headers
    proxy_set_header X-Forwarded-For "";
    proxy_set_header X-Real-IP "";

    proxy_pass http://wordpress_backend;
}