Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0 - Unauthenticated Insecure Direct Object Reference

2026-06-25 00:00

Jakub Herman

Strategic Overview

Status

Patched in 3.1.0

Affected PluginPayment Gateway Based Fees and Discounts for WooCommerce

Affected Version<= 3.0.0

CVSS5.3Medium

CVECVE-2026-56048

View all Payment Gateway Based Fees and Discounts for WooCommerce vulnerabilities

Vulnerability Overview

The Payment Gateway Based Fees and Discounts for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.0.0 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Technical Analysis

REMEDIATION: Update to version 3.1.0, or a newer patched version --- IDENTIFIER: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

External References

https://www.cve.org/CVERecord?id=CVE-2026-56048 https://www.wordfence.com/threat-intel/vulnerabilities/id/6730f4a3-e915-434a-9f0a-2e96021915ac

Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0 - Unauthenticated Insecure Direct Object Reference (CVE-2026-56048)