CVE-2026-12966 Overview
CVE-2026-12966 is a broken access control vulnerability [CWE-284] in the Direct Payments for WooCommerce WordPress plugin before version 2.5.3. The plugin fails to verify order ownership in several unauthenticated AJAX handlers. Attackers can change order status and overwrite payment metadata without authentication. This allows tampering with other customers' orders, forging a payment sent state, overwriting the payment-method label, and attaching forged payment-proof files. The flaw affects the integrity of e-commerce transactions processed through affected WooCommerce stores.
Critical Impact
Unauthenticated remote attackers can manipulate arbitrary WooCommerce orders, forge payment confirmations, and upload malicious payment-proof files, undermining transaction integrity across affected stores.
Affected Products
- Direct Payments for WooCommerce WordPress plugin versions prior to 2.5.3
- WooCommerce stores running the vulnerable plugin
- WordPress sites exposing the plugin's unauthenticated AJAX endpoints
Discovery Timeline
- 2026-08-01 - CVE-2026-12966 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-12966
Vulnerability Analysis
The Direct Payments for WooCommerce plugin exposes multiple AJAX handlers intended to let customers report payment activity against their own orders. These handlers accept an order identifier from the request but do not confirm that the requester owns the referenced order. Because the endpoints are reachable without authentication, any remote party can supply an arbitrary order ID and trigger the underlying business logic. The affected operations modify order state and persist attacker-controlled metadata into the WooCommerce order record.
Successful exploitation lets an attacker mark a victim's order as paid, replace the recorded payment-method label with arbitrary text, and attach forged payment-proof files to the order. Store operators viewing these tampered orders may treat them as legitimately paid and ship goods without receiving funds. The vulnerability affects transaction integrity rather than confidentiality, matching the low integrity impact reflected in the CVSS scoring.
Root Cause
The root cause is missing authorization enforcement [CWE-284] in unauthenticated AJAX handlers. The plugin registers actions accessible to non-logged-in users through the wp_ajax_nopriv_ hook family and processes order-modifying operations without a nonce check, capability check, or verification that the current session owns the target order. Order identifiers are treated as sufficient authority, effectively acting as guessable references to sensitive objects.
Attack Vector
Exploitation requires only network access to the target WordPress site. An attacker enumerates or guesses sequential WooCommerce order IDs and issues crafted HTTP POST requests to the vulnerable admin-ajax.php actions. Each request specifies the target order ID along with attacker-supplied payment metadata or a file upload representing the forged payment proof. No authentication, user interaction, or elevated privileges are required. Further technical detail is available in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-12966
Indicators of Compromise
- Unauthenticated POST requests to /wp-admin/admin-ajax.php referencing Direct Payments for WooCommerce actions from unfamiliar IP addresses
- WooCommerce orders whose status changed to a paid state without corresponding gateway transaction records
- Order metadata containing unexpected payment-method labels or attached files with suspicious extensions
- Sudden increase in order status transitions originating from a small set of source IPs
Detection Strategies
- Correlate WooCommerce order status changes against authenticated admin sessions and payment gateway callbacks to identify unauthorized transitions
- Inspect web server access logs for repeated admin-ajax.php calls containing plugin-specific action parameters from unauthenticated clients
- Alert on file uploads placed in WooCommerce order attachment directories that do not originate from authenticated customer sessions
Monitoring Recommendations
- Monitor the wp_postmeta table for rapid changes to _payment_method, _payment_method_title, and related order meta keys
- Enable audit logging for all WooCommerce order status transitions and retain logs for forensic review
- Track outbound file writes to the WordPress uploads directory tied to order attachments
How to Mitigate CVE-2026-12966
Immediate Actions Required
- Update the Direct Payments for WooCommerce plugin to version 2.5.3 or later on all affected WordPress sites
- Audit recent WooCommerce orders for unexpected status changes, altered payment-method labels, or unfamiliar payment-proof attachments
- Restrict access to admin-ajax.php at the web application firewall layer for known plugin action names until patching is confirmed
Patch Information
The vendor addressed the issue in Direct Payments for WooCommerce version 2.5.3 by adding ownership verification to the affected AJAX handlers. Site operators should apply the update through the WordPress plugin dashboard or by deploying the packaged release. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Disable the Direct Payments for WooCommerce plugin until the patched version is deployed
- Block unauthenticated requests to the plugin's AJAX actions using a web application firewall rule
- Require manual verification of every order marked as paid through the plugin before fulfillment
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
