CVE-2026-82215: PayPay for WooCommerce Auth Bypass Flaw

CVE-2026-82215 Overview

CVE-2026-82215 affects the Payment Gateway PayPay for WooCommerce WordPress plugin, versions 0.5 through 0.9.3. The plugin fails to verify the authenticity of incoming payment notifications before processing them. Unauthenticated attackers who know the store's merchant identifier can mark arbitrary orders as paid, or force orders into cancelled or failed states. The flaw maps to [CWE-345] Insufficient Verification of Data Authenticity. Because integrity of order state is directly impacted, merchants risk shipping unpaid goods or losing legitimate transactions.

Critical Impact
Unauthenticated attackers with knowledge of the merchant identifier can manipulate WooCommerce order state, marking unpaid orders as completed or canceling legitimate transactions.

Affected Products

Payment Gateway PayPay for WooCommerce WordPress plugin version 0.5
Payment Gateway PayPay for WooCommerce WordPress plugin versions 0.6 through 0.9.2
Payment Gateway PayPay for WooCommerce WordPress plugin version 0.9.3

Discovery Timeline

2026-09-11 - CVE-2026-82215 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-82215

Vulnerability Analysis

The Payment Gateway PayPay for WooCommerce plugin exposes an endpoint that receives asynchronous payment notifications from PayPay. The plugin acts on these notifications to transition WooCommerce order state. It does not cryptographically validate that the notification originated from PayPay's servers. Any HTTP client that can reach the site and supply a valid merchant identifier can submit forged notifications.

Successful exploitation lets an attacker mark unpaid orders as completed, triggering downstream fulfillment logic in WooCommerce. Attackers can also flip orders into cancelled or failed states, disrupting revenue and customer experience. The vulnerability affects integrity but does not expose stored data or take the site offline.

Root Cause

The plugin's notification handler trusts inbound requests based solely on the presence of the merchant identifier. It omits signature verification, HMAC validation, or callback authentication against PayPay's API. The merchant identifier is not a secret in the strict sense and can be enumerated or leaked through order metadata and receipts.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. The attacker sends a crafted HTTP POST request to the plugin's notification callback URL. The request supplies the target merchant identifier and an order reference along with a status value indicating payment success or failure. Attack complexity is elevated because the attacker must first learn the merchant identifier and a valid order ID. See the WPScan Vulnerability Report for the technical writeup.

// No verified public exploit code is available.
// See the WPScan advisory for technical details on the notification handler.

Detection Methods for CVE-2026-82215

Indicators of Compromise

Orders transitioning to completed status without a corresponding PayPay settlement record in the merchant back-office.
Repeated HTTP POST requests to the PayPay notification callback path from unfamiliar IP addresses or non-PayPay ASNs.
Sudden bursts of order state changes to cancelled or failed outside of normal customer activity windows.

Detection Strategies

Correlate WooCommerce order status transitions with PayPay merchant portal transaction records to surface mismatches.
Inspect web server access logs for requests to the plugin's notification endpoint that lack the expected PayPay source IP ranges or User-Agent strings.
Alert on order state transitions that occur outside of the normal payment flow, particularly when no prior checkout session exists.

Monitoring Recommendations

Enable verbose logging for the payment gateway plugin and forward logs to a centralized SIEM for retention and analysis.
Monitor the WooCommerce woocommerce_order_status_changed action for anomalous frequency or unexpected transitions.
Track outbound reconciliation jobs that compare gateway settlements to internal order ledgers and alert on drift.

How to Mitigate CVE-2026-82215

Immediate Actions Required

Update the Payment Gateway PayPay for WooCommerce plugin to a version later than 0.9.3 as soon as a fix is published.
Audit recent orders in completed, cancelled, or failed state against PayPay merchant portal records and reverse any unauthorized transitions.
Rotate exposed merchant identifiers where the PayPay platform permits and review any public locations that may leak them.

Patch Information

At the time of publication, the WPScan advisory lists versions 0.5 through 0.9.3 as vulnerable. Administrators should apply the vendor's patched release once available and confirm the notification handler performs signature verification against PayPay's callbacks.

Workarounds

Restrict access to the plugin's notification callback endpoint at the web server or WAF layer to PayPay's published source IP ranges.
Temporarily disable the Payment Gateway PayPay for WooCommerce plugin and switch to an alternative supported payment method until patched.
Add a reverse-proxy rule that requires a shared secret header on the notification endpoint and configure PayPay to include it if the platform supports custom headers.

bash

# Example nginx snippet restricting the notification endpoint by source IP
location ~* /wc-api/paypay_notification {
    allow 203.0.113.0/24;   # Replace with PayPay's documented source ranges
    deny  all;
    proxy_pass http://wordpress_backend;
}