CVE-2026-87974: Asaas Gateway WooCommerce Auth Bypass Flaw

CVE-2026-87974 Overview

CVE-2026-87974 affects the Asaas Gateway for WooCommerce WordPress plugin in versions prior to 2.7.8. The plugin fails to properly authenticate its payment webhook endpoint. In its default configuration, the webhook accepts an empty access token. The plugin also does not verify that the confirmed payment corresponds to the order it marks as paid. Unauthenticated attackers can send crafted webhook requests to mark arbitrary WooCommerce orders as paid. This authentication weakness is categorized under [CWE-287] Improper Authentication.

Critical Impact
Remote, unauthenticated attackers can mark arbitrary WooCommerce orders as paid, enabling order fraud against affected merchants.

Affected Products

Asaas Gateway for WooCommerce WordPress plugin versions before 2.7.8
WordPress sites running WooCommerce with the vulnerable plugin installed
Deployments relying on the plugin's default webhook configuration

Discovery Timeline

2026-10-14 - CVE CVE-2026-87974 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-87974

Vulnerability Analysis

The plugin exposes a public webhook endpoint intended to receive payment confirmations from the Asaas payment gateway. Two independent flaws combine to produce the issue. First, the endpoint accepts an empty access token when the plugin runs with its default configuration. Second, the handler does not validate that the payment identifier in the webhook payload corresponds to the WooCommerce order being marked as paid.

An attacker who knows or guesses a target order identifier can call the webhook with an empty token and an arbitrary payment reference. The plugin treats the request as authentic and transitions the order into a paid state. This bypasses the merchant's payment verification entirely.

Root Cause

The root cause is improper authentication [CWE-287] on the webhook handler. The handler trusts caller-supplied data without binding the confirmed payment to the referenced order. A secure design would reject empty tokens, require a shared secret or signed payload, and verify that the payment object returned by the gateway matches the order amount, currency, and identifier.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. An attacker sends an HTTP request to the plugin's webhook URL with a crafted body referencing a target order. Because the default configuration accepts an empty access token, no credential is required. Full technical details are available in the WPScan Vulnerability Advisory.

Detection Methods for CVE-2026-87974

Indicators of Compromise

WooCommerce orders transitioning to the paid state without a corresponding settlement in the Asaas merchant dashboard.
HTTP POST requests to the Asaas webhook endpoint from IP addresses that do not belong to Asaas infrastructure.
Webhook requests containing missing, empty, or malformed access token headers or parameters.
Orders marked paid where the payment identifier referenced in logs does not match any real transaction.

Detection Strategies

Reconcile WooCommerce order status changes against authoritative Asaas transaction records on a scheduled basis.
Inspect web server access logs for requests to the plugin webhook route and flag entries lacking a valid token.
Alert on bursts of order status transitions to paid occurring outside normal checkout flows.

Monitoring Recommendations

Forward WordPress, WooCommerce, and reverse-proxy logs into a centralized SIEM for correlation.
Monitor for anomalous POST request volume to /wp-json/ and plugin-specific webhook paths.
Track order fulfillment events and compare them against payment gateway settlement reports daily.

How to Mitigate CVE-2026-87974

Immediate Actions Required

Upgrade the Asaas Gateway for WooCommerce plugin to version 2.7.8 or later immediately.
Audit all WooCommerce orders processed since the plugin was installed for unauthorized paid status transitions.
Rotate any webhook access tokens and ensure a non-empty value is configured.
Review fulfillment queues and hold shipments for suspicious orders pending reconciliation.

Patch Information

The vendor addressed the issue in version 2.7.8 of the Asaas Gateway for WooCommerce plugin. The patch enforces webhook authentication and validates that the confirmed payment matches the referenced order. Refer to the WPScan Vulnerability Advisory for remediation details.

Workarounds

Configure a strong, non-empty webhook access token in the plugin settings if an immediate upgrade is not possible.
Restrict access to the webhook endpoint at the web server or WAF layer to Asaas source IP ranges.
Temporarily disable the plugin and process payments through an alternative gateway until patched.

bash

# Example nginx restriction limiting the Asaas webhook endpoint to known source ranges
location ~ ^/wp-json/asaas/ {
    allow 203.0.113.0/24;   # Replace with Asaas documented IP ranges
    deny all;
    proxy_pass http://wordpress_backend;
}