Executive brief
The PayU CommercePro plugin for WordPress, which facilitates payments for WooCommerce stores, contains a security flaw in how it handles payment notifications. An unauthorized attacker can send fake payment updates to the website to modify order details, such as reducing the total price to zero or changing shipping information. This could lead to financial loss for the merchant and corrupted order records without the attacker needing a valid account or payment.
Technical details
The vulnerability exists in the plugin's handling of the 'get-payment-success-update' REST API endpoint. The plugin processes and persists order modifications—such as applying discounts, changing shipping titles, and updating metadata—before verifying the cryptographic signature of the payment gateway notification. An attacker can provide a non-empty 'key' and a target 'txnid' to trigger these database writes. Even if the subsequent signature check fails, the tampered data (e.g., a massive discount fee) remains committed to the WooCommerce order in the database. As of the advisory date, there is no known fix for this issue.
Affected products
- PayU India PayU CommercePro Plugin <= 3.8.9
Timeline
- 2026-05-06: disclosed
- 2026-07-29: advisory: NVD publication date