CVE-2026-66473: Xendit Payment Auth Bypass Vulnerability

CVE-2026-66473 Overview

CVE-2026-66473 is a broken access control vulnerability in the Xendit Payment plugin for WordPress, affecting versions up to and including 7.1.0. The flaw allows unauthenticated attackers to reach functionality that should be restricted to authorized users. The weakness maps to CWE-862: Missing Authorization. Successful exploitation compromises data integrity within the affected WooCommerce environment. The vulnerability is exploitable over the network without user interaction or prior authentication.

Critical Impact

Unauthenticated attackers can invoke protected plugin functionality across the network, undermining integrity of payment-related operations in WooCommerce sites running the vulnerable plugin.

Affected Products

• WordPress Xendit Payment plugin (woo-xendit-virtual-accounts)
• Versions <= 7.1.0
• WooCommerce sites integrating Xendit virtual accounts

Discovery Timeline

• 2026-07-27 - CVE-2026-66473 published to NVD
• 2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-66473

Vulnerability Analysis

The Xendit Payment plugin exposes one or more endpoints that fail to enforce authorization checks before executing privileged actions. An attacker sends crafted HTTP requests over the network and reaches functions intended for authenticated or higher-privileged users. The result is unauthorized modification of state within the plugin.

The advisory from Patchstack classifies this as a broken access control issue impacting integrity but not confidentiality or availability. The vulnerability requires no credentials, no user interaction, and low attack complexity, making automated abuse practical against exposed WordPress sites. The EPSS probability is 0.202% with a percentile of 10.323.

Root Cause

The root cause is a missing authorization check ([CWE-862]) on request handlers within the plugin. The code executes sensitive operations without validating whether the requester possesses the required capability or nonce. This design gap enables anonymous callers to trigger flows reserved for administrators or authenticated users.

Attack Vector

An attacker delivers HTTP requests to vulnerable plugin endpoints on a target WordPress site. Because no authentication or user interaction is required, exploitation is scriptable against any internet-facing installation. The impact is limited to integrity, meaning attackers can alter plugin-controlled data or state but the flaw itself does not directly leak data or crash the site.

Refer to the Patchstack Vulnerability Report for further technical detail on the affected endpoints.

Detection Methods for CVE-2026-66473

Indicators of Compromise

• Unauthenticated POST or GET requests to Xendit plugin endpoints under /wp-content/plugins/woo-xendit-virtual-accounts/ or corresponding AJAX/REST routes.
• Unexpected changes to Xendit virtual account records or WooCommerce order metadata without a matching authenticated admin session.
• Bursts of anonymous requests targeting plugin action handlers from a single IP or distributed sources.

Detection Strategies

• Enable WordPress access logging and alert on anonymous requests reaching plugin action or AJAX endpoints associated with woo-xendit-virtual-accounts.
• Deploy a web application firewall rule to flag requests to Xendit plugin routes lacking a valid authentication cookie or nonce.
• Baseline normal plugin traffic and identify deviations in request volume, source distribution, or parameter patterns.

Monitoring Recommendations

• Monitor WordPress audit logs for changes to plugin-managed data initiated outside authenticated admin sessions.
• Track outbound calls from the site to Xendit APIs for anomalies indicating tampered payment flows.
• Correlate webserver logs with WooCommerce order events to detect state changes without a matching user action.

How to Mitigate CVE-2026-66473

Immediate Actions Required

• Upgrade the Xendit Payment plugin to a version later than 7.1.0 once released by the vendor.
• Restrict access to /wp-admin and plugin endpoints using IP allowlisting or authentication at the reverse proxy where feasible.
• Review recent Xendit-related transactions and plugin configuration for unauthorized modifications.

Patch Information

Consult the Patchstack Vulnerability Report for the latest fixed version and vendor guidance. Apply the patched release across all WordPress sites using the woo-xendit-virtual-accounts plugin.

Workarounds

• Deactivate the Xendit Payment plugin until a fixed version is installed if payment flows can be temporarily suspended.
• Add web application firewall rules that block unauthenticated requests to the plugin's action and REST endpoints.
• Enforce strict role and capability checks at the reverse proxy or WAF layer for administrative plugin routes.

# Example ModSecurity rule to block unauthenticated access to plugin endpoints
SecRule REQUEST_URI "@contains /wp-content/plugins/woo-xendit-virtual-accounts/" \
  "id:1026066473,phase:1,deny,status:403,\
  chain,msg:'Block unauthenticated Xendit plugin access - CVE-2026-66473'"
  SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"