Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 - Unauthenticated Arbitrary Order Payment Bypass
Strategic Overview
- Status
- Patched in 1.7.3
- Affected Version
<= 1.7.2- CVSS
- 5.3Medium
- Weakness type
- CWE-602 · Client-Side Enforcement of Server-Side Security
- CVE
CVE-2026-107420
At a glance
CVE-2026-107420 is a medium-severity Client-Side Enforcement of Server-Side Security vulnerability in the Pay With MetaMask For WooCommerce WordPress plugin, affecting versions <= 1.7.2. It carries a CVSS score of 5.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 1.7.3; sites on affected versions should update now. Disclosed October 2026, reported by luffy.
Vulnerability Overview
The Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway plugin for WordPress is vulnerable to Bypass Vulnerability in all versions up to, and including, 1.7.2. This is due to the transaction verification function accepted a caller-supplied amount and read the receiver address from global plugin settings rather than from trusted order metadata, allowing the expected payment parameters to be manipulated by the client. This makes it possible for unauthenticated attackers to mark WooCommerce orders as paid without completing a valid on-chain payment matching the order's expected receiver, amount, and token contract.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.
CWE-602: Client-Side Enforcement of Server-Side Security
The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
Remediation
Update to version 1.7.3, or a newer patched version
How does WordSec protect against this?
This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: Pay With MetaMask For WooCommerce 1.7.3 closes this, and updating the plugin is the step that ends it.
- Login Security
- Alerts
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C