Executive brief
Autopay is a WordPress plugin that handles online payments for e-commerce sites. A vulnerability in its payment processing allows attackers without authorization to view and delete payment information (credit cards, payment details) belonging to other customers' orders, potentially leading to fraud, identity theft, or service disruption for legitimate buyers.
Technical details
The Autopay plugin before version 5.0.1 fails to validate cryptographic signatures on payment callback requests, enabling broken access control (CWE-863). An unauthenticated attacker can craft requests to the vulnerable callback endpoint to access and delete stored payment parameters of arbitrary customer orders without requiring authentication or authorization. The vulnerability is reachable over the network via HTTP requests to the plugin's payment webhook endpoint. The flaw allows disclosure of sensitive payment data and removal of payment records, impacting both confidentiality and availability. A fix is available in version 5.0.1 and later.
Affected products
- Autopay Autopay before 5.0.1
Timeline
- 2026-09-15: disclosed
- 2026-09-17: advisory
- 2026: patched: Fix available in version 5.0.1