ePayco plugin for WooCommerce < 8.4.7 - Unauthenticated Unauthorized Order Status Manipulation

The ePayco plugin for WooCommerce plugin for WordPress is vulnerable to Payment Bypass in all versions up to 8.4.7. This is due to missing mandatory signature verification in the payment confirmation callback handler, where the HMAC signature check was only computed under a conditional and could be bypassed by omitting required fields, and the check_ipn_response function unconditionally accepted all incoming requests with if(true). This makes it possible for unauthenticated attackers to mark arbitrary WooCommerce orders as paid by sending a crafted payment confirmation callback without a valid ePayco gateway signature.

This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: ePayco plugin for WooCommerce 8.4.7 closes this, and updating the plugin is the step that ends it.

• Login Security
• Alerts