Missing authorization in UniPAY Payment Gateway For WooCommerce
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from CNA.
Summary
The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not check authorization before returning an order's order-received URL for an attacker-supplied order id. Unauthenticated remote attackers can use this to obtain the order's secret key and enumerate orders. This exposes customers' names, email addresses, phone numbers and addresses. A public exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-11-09
Description from the CNA
The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before returning an order's order-received URL for an attacker-supplied order id, exposing the order's secret key in the redirect and allowing unauthenticated attackers to enumerate orders and disclose customers' personal data (name, email address, phone number and address).
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | UniPAY Payment Gateway For WooCommerce | before 2.4 | 2.4 | Patch available | CNA |
- UniPAY Payment Gateway For WooCommerce VendorUnknown Affected before 2.4 Fixed in 2.4 Patch available CNA
Remediation
Update UniPAY Payment Gateway For WooCommerce to version 2.4.
Written with Claude Haiku 5.5 from the sources below · 2026-11-09
- Fix · CNA UniPAY Payment Gateway For WooCommerce (Unknown) Fixed in 2.4
Timeline
- 2026-11-09 Threatist record created from CVE-2026-123088
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences