Asaas Gateway for WooCommerce
Asaas Gateway for WooCommerce has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.
The most common weakness is Insufficient Verification Of Data Authenticity, behind 1 of the records (100%).
The one issue recorded for Asaas Gateway for WooCommerce has a vendor fix available, so running the current release closes it.
All of these findings were reported by Guillermo Álvarez Fernández. Asaas Gateway for WooCommerce is installed on roughly 8,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-87974Asaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Arbitrary Order Status Manipulation
Read the full analysisVulnerability Records
Asaas Gateway for WooCommerce
Author
Asaas
Use Asaas as a payment method for your store. This plugin is an implementation of the Asaas API v3. The checkout process is completely transparent, with the entire payment flow taking place within your store, without the need to access our invoice. The data is sent to Asaas, which processes the payment and automatically returns the transaction status. With this plugin, you can use the following features: PIX Bank Slip Credit Card Payment Split One-Click Buy Automatic Advance (for business customers) Installments up to 12x Interest configuration based on the number of installments Subscription Creation (using WooCommerce Subscriptions) For any questions about plugin installation and integration, we provide an installation tutorial as well as an explanation of the most common errors, in our documentation. If you still need support, you can contact our integrations team via email at integracoes@asaas.com.br.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C