CVE-2026-0656
Published: 07 January 2026
Summary
CVE-2026-0656 is a high-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-0656, published on 2026-01-07, is a missing authentication vulnerability (CWE-862) in the iPaymu Payment Gateway for WooCommerce plugin for WordPress, affecting all versions up to and including 2.0.2. The flaw exists in the 'check_ipaymu_response' function, which does not properly validate incoming webhook requests through signature verification or origin checks, allowing unauthorized access to sensitive order processing functionality.
Unauthenticated attackers can exploit this vulnerability remotely with low attack complexity and no user interaction or privileges required (CVSSv3.1 Base Score: 8.2; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). Exploitation involves sending crafted POST requests to the webhook endpoint to falsely mark WooCommerce orders as paid without any actual payment occurring. Attackers can also use GET requests to enumerate order IDs and obtain valid order keys, resulting in exposure of customer personally identifiable information, including names, addresses, and details of purchased products.
Mitigation details are available in advisories such as the Wordfence threat intelligence report and WordPress plugin trac references, which highlight the vulnerable code in gateway.php (lines 316-336 and 370-380) and a relevant changeset at revision 3429657, indicating a patch has been applied in subsequent versions. Security practitioners should update the iPaymu Payment Gateway for WooCommerce plugin beyond version 2.0.2 to address this issue.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1237
Vulnerability details
The iPaymu Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 2.0.2 via the 'check_ipaymu_response' function. This is due to the plugin not validating webhook request authenticity through signature verification…
more
or origin checks. This makes it possible for unauthenticated attackers to mark WooCommerce orders as paid by sending crafted POST requests to the webhook endpoint without any payment occurring, as well as enumerate order IDs and obtain valid order keys via GET requests, exposing customer order PII including names, addresses, and purchased products.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication in public-facing WordPress plugin webhook enables unauthenticated remote exploitation for order status manipulation and PII disclosure, directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring timely patching of the iPaymu plugin to versions beyond 2.0.2 that include proper webhook authentication via signature verification or origin checks.
Requires validation of webhook request inputs for authenticity through signatures or origins, preventing crafted POST requests from marking orders as paid and GET requests from enumerating order IDs.
Enforces approved access authorizations on the vulnerable check_ipaymu_response function, blocking unauthenticated remote exploitation of order processing and PII exposure.