Executive brief
The Direct Payments for WooCommerce plugin for WordPress, which facilitates payment processing for online stores, contains a security flaw that allows unauthorized individuals to modify customer orders. An attacker can change the status of an order to 'payment sent' without actually paying, overwrite payment details, or attach fake proof-of-payment files. This could lead to financial loss for merchants who fulfill orders based on these fraudulent status updates.
Technical details
The vulnerability is a broken access control issue (CWE-284) within the plugin's AJAX handlers. Specifically, several 'digages' AJAX actions fail to validate that the user making the request is the owner of the WooCommerce order being modified. Because these handlers are accessible to unauthenticated users, a remote attacker can send crafted requests to change an order's status (e.g., to 'payment sent'), overwrite the payment-method label, and upload forged payment-proof files. This allows for cross-customer order tampering and potential fraud. The issue is resolved in version 2.5.3.
Affected products
- Unknown Direct Payments for WooCommerce < 2.5.3
Timeline
- 2026-07-17: disclosed: Publicly published by WPScan
- 2026-07-31: patched: Last updated with fix information
- 2026-08-01: advisory: NVD publication date