Executive brief
The ePayco Payment Gateway plugin for WooCommerce is a payment processing extension used to accept payments through the ePayco payment provider on online stores. A vulnerability in versions before 8.4.7 allows attackers to mark orders as paid without actually processing a payment or providing valid authentication, leading to financial loss and order fulfillment for unpaid purchases.
Technical details
This plugin contains an authentication bypass vulnerability in payment confirmation handling (CVE-2026-84043). When the webhook reference parameter is omitted, the plugin fails to compute an expected HMAC signature, leaving it null; the vulnerability stems from a loose PHP comparison (==) that treats null equal to an empty string, allowing attackers to forge payment confirmations. An unauthenticated attacker can craft two requests to the WooCommerce API endpoint to transition an order from pending to paid status without providing a valid gateway signature or making an actual payment. The attack requires only knowledge of the order ID and total amount (both visible to the attacker during guest checkout) and succeeds when WooCommerce and the ePayco gateway are active in default live mode. The vulnerability was fixed in version 8.4.7.
Affected products
- ePayco Payment Gateway for WooCommerce before 8.4.7
Timeline
- 2026-09-02: disclosed
- 2026-09-04: advisory
- 2026-09-04: patched: Fixed in version 8.4.7