CVE-2026-39448: NOWPayments WooCommerce Auth Bypass Flaw

CVE-2026-39448 Overview

CVE-2026-39448 is an unauthenticated broken access control vulnerability in the NOWPayments for WooCommerce WordPress plugin. All versions up to and including 1.4.0 are affected. The flaw is classified under CWE-862: Missing Authorization, indicating the plugin fails to verify user permissions before executing sensitive operations.

Remote attackers can reach the vulnerable functionality over the network without authentication or user interaction. The issue primarily impacts data integrity within WooCommerce environments that process cryptocurrency payments through NOWPayments.

Critical Impact
Unauthenticated attackers can invoke privileged plugin functionality over the network, potentially manipulating payment-related state within WooCommerce stores.

Affected Products

NOWPayments for WooCommerce plugin versions <= 1.4.0
WordPress sites running WooCommerce with the NOWPayments plugin installed
E-commerce environments accepting cryptocurrency payments via NOWPayments

Discovery Timeline

2026-07-02 - CVE-2026-39448 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-39448

Vulnerability Analysis

The NOWPayments for WooCommerce plugin exposes functionality that lacks proper authorization enforcement. Under [CWE-862], the plugin performs a sensitive action without verifying whether the requesting user possesses the required privileges. This design flaw allows unauthenticated HTTP requests to reach code paths that should be restricted to authenticated administrators or the payment gateway callback flow.

Because the attack vector is network-based and requires no privileges or user interaction, an attacker only needs to send crafted HTTP requests to the vulnerable endpoint. The impact centers on integrity, meaning attackers can modify data or trigger state changes rather than exfiltrate confidential information or crash the service.

Root Cause

The root cause is missing authorization checks on one or more plugin endpoints. WordPress plugins typically enforce authorization using current_user_can(), nonce validation via check_admin_referer() or wp_verify_nonce(), and capability checks on AJAX or REST routes. When these checks are absent or improperly implemented, any unauthenticated visitor can invoke handlers that should be gated behind privileged access.

Attack Vector

An attacker sends unauthenticated HTTP requests directly to the vulnerable plugin endpoint. Because no authentication token, nonce, or capability check gates the handler, the plugin processes the request as if issued by an authorized party. Attackers can automate exploitation against internet-facing WooCommerce sites at scale.

No verified proof-of-concept code is currently published. Refer to the Patchstack Vulnerability Report for additional technical context as it becomes available.

Detection Methods for CVE-2026-39448

Indicators of Compromise

Unexpected HTTP POST or GET requests to NOWPayments plugin endpoints under /wp-content/plugins/nowpayments-for-woocommerce/ or associated AJAX and REST routes
Modifications to WooCommerce order status or payment records without corresponding authenticated administrator sessions
Repeated requests from single source IP addresses targeting plugin-specific action parameters

Detection Strategies

Review web server access logs for unauthenticated requests to admin-ajax.php referencing NOWPayments actions or to REST namespaces registered by the plugin
Compare WooCommerce order state transitions against authenticated user session records to identify anomalous changes
Deploy web application firewall rules that flag requests to plugin endpoints lacking valid WordPress authentication cookies or nonces

Monitoring Recommendations

Enable WordPress audit logging to capture plugin option changes and order modifications with source IP attribution
Alert on outbound requests to unknown cryptocurrency wallet destinations originating from the WooCommerce host
Monitor plugin file integrity and configuration values for unauthorized changes

How to Mitigate CVE-2026-39448

Immediate Actions Required

Identify all WordPress installations running NOWPayments for WooCommerce and confirm the installed version
Disable the plugin on sites running version 1.4.0 or earlier until a patched release is applied
Restrict access to WordPress administrative and AJAX endpoints using IP allowlisting or WAF policies where feasible

Patch Information

At the time of publication, no fixed version is documented in the NVD entry. Administrators should consult the Patchstack Vulnerability Report and the plugin's official channels for a release addressing CVE-2026-39448. Upgrade to a version later than 1.4.0 once available.

Workarounds

Deactivate and remove the NOWPayments for WooCommerce plugin until a patched version is released
Deploy virtual patching through a WAF to block unauthenticated requests to plugin-specific admin-ajax.php actions and REST routes
Enforce strong authentication and least-privilege capabilities across WordPress user accounts to limit blast radius from adjacent compromises

bash

# Configuration example: block unauthenticated access to NOWPayments plugin endpoints via nginx
location ~* /wp-content/plugins/nowpayments-for-woocommerce/ {
    deny all;
    return 403;
}