CVE-2026-16738: Conekta Payment Gateway Auth Bypass Flaw

CVE-2026-16738 Overview

The Conekta Payment Gateway plugin for WordPress contains a broken access control flaw in versions before 6.2.2. The plugin does not verify the authenticity of incoming webhook notifications from the payment gateway. It also fails to bind confirmed payments to the targeted order or validate the payment amount. Unauthenticated attackers can send crafted webhook requests to mark arbitrary orders as paid without submitting any payment. The issue is categorized as improper access control [CWE-284] and affects WooCommerce stores that rely on the plugin for checkout processing.

Critical Impact
Unauthenticated remote attackers can mark arbitrary WooCommerce orders as paid, causing direct financial loss to merchants using vulnerable versions of the plugin.

Affected Products

Conekta Payment Gateway WordPress plugin versions before 6.2.2
WordPress sites using the plugin for WooCommerce checkout
E-commerce merchants integrating Conekta as a payment method

Discovery Timeline

2026-08-22 - CVE-2026-16738 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-16738

Vulnerability Analysis

The Conekta Payment Gateway plugin exposes a webhook endpoint that WooCommerce uses to receive payment confirmation events from the Conekta payment processor. In versions before 6.2.2, the endpoint accepts incoming notifications without validating their source. The plugin does not verify webhook signatures, shared secrets, or the origin of the request.

The handler compounds the problem by trusting attacker-controlled data in the request body. It does not confirm that the referenced payment belongs to the order being marked as paid. It also does not compare the reported payment amount against the order total. An attacker who knows or guesses a WooCommerce order identifier can submit a forged notification and transition the order to a paid state.

Because the flaw resides in an unauthenticated webhook handler, exploitation requires no credentials, no user interaction, and only network access to the target store.

Root Cause

The root cause is missing authentication and missing integrity checks on webhook messages, combined with a business logic flaw in the payment reconciliation code path. The plugin treats any HTTP request reaching the webhook route as a legitimate payment confirmation.

Attack Vector

An attacker enumerates order identifiers, for example by placing a legitimate order or by observing sequential order numbering. The attacker then issues an HTTP POST request to the plugin's webhook URL containing a crafted JSON payload that references the target order. The plugin processes the payload as a valid payment event and updates the order status to paid, allowing fulfillment of goods or services without payment. Technical details are documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-16738

Indicators of Compromise

HTTP POST requests to the Conekta webhook endpoint from unexpected source IP addresses outside Conekta's published IP ranges
WooCommerce orders transitioning from pending to processing or completed without a corresponding charge in the Conekta merchant dashboard
Order notes referencing webhook-driven status changes that lack a matching Conekta transaction identifier
Repeated webhook calls referencing sequential or non-existent order IDs, indicating enumeration

Detection Strategies

Reconcile WooCommerce order records against the Conekta merchant portal daily to identify orders marked paid without a matching charge
Deploy web application firewall rules that log and inspect requests to the plugin webhook path
Alert on any webhook request that does not originate from documented Conekta infrastructure

Monitoring Recommendations

Enable verbose logging on the WooCommerce payment gateway and export logs to a central store
Monitor for anomalous fulfillment activity such as high-value orders paid through Conekta with no prior customer history
Track the plugin version across all WordPress sites in inventory and flag any instance below 6.2.2

How to Mitigate CVE-2026-16738

Immediate Actions Required

Update the Conekta Payment Gateway plugin to version 6.2.2 or later on every WordPress site
Audit recent WooCommerce orders paid via Conekta and cross-check each transaction against the Conekta dashboard
Suspend fulfillment for orders with unverified payment status until reconciliation is complete
Rotate any Conekta API keys if tampering is suspected

Patch Information

The vendor addressed the vulnerability in Conekta Payment Gateway version 6.2.2. The fixed release adds authenticity verification for incoming webhook notifications and binds confirmed payments to the corresponding order with amount validation. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Temporarily disable the Conekta payment method in WooCommerce until the plugin is upgraded
Restrict access to the webhook endpoint at the web server or WAF layer to Conekta's documented source IP ranges
Require manual order review before fulfillment for any order paid through Conekta

bash

# Example nginx configuration to restrict access to the Conekta webhook path
location ~ ^/\?wc-api=WC_Conekta_Gateway {
    allow 200.52.0.0/16;   # Replace with Conekta's published source ranges
    deny all;
    try_files $uri $uri/ /index.php?$args;
}