CVE-2026-0692

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0692", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-07T20:56:45.998Z", "datePublished": "2026-02-14T04:35:43.208Z", "dateUpdated": "2026-04-08T17:27:47.544Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:27:47.544Z"}, "affected": [{"vendor": "bluesnap", "product": "BlueSnap Payment Gateway for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.4.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The BlueSnap Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.4.0. This is due to the plugin relying on WooCommerce's `WC_Geolocation::get_ip_address()` function to validate IPN requests, which trusts user-controllable headers like X-Real-IP and X-Forwarded-For to determine the client IP address. This makes it possible for unauthenticated attackers to bypass IP allowlist restrictions by spoofing a whitelisted BlueSnap IP address and send forged IPN (Instant Payment Notification) data to manipulate order statuses (mark orders as paid, failed, refunded, or on-hold) without proper authorization."}], "title": "BlueSnap Payment Gateway for WooCommerce <= 3.4.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Manipulation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dc676e18-c895-4f6a-bce9-1f92207af885?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/bluesnap-payment-gateway-for-woocommerce/trunk/includes/class-wc-bluesnap-ipn-webhooks.php#L417"}, {"url": "https://plugins.trac.wordpress.org/browser/bluesnap-payment-gateway-for-woocommerce/tags/3.4.0/includes/class-wc-bluesnap-ipn-webhooks.php#L417"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan"}], "timeline": [{"time": "2026-02-13T16:19:36.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-18T18:47:41.524502Z", "id": "CVE-2026-0692", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T18:47:56.615Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0692", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-18T18:47:41.524502Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T18:47:53.501Z"}}], "cna": {"title": "BlueSnap Payment Gateway for WooCommerce <= 3.4.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Manipulation", "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}}], "affected": [{"vendor": "bluesnap", "product": "BlueSnap Payment Gateway for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.4.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-13T16:19:36.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dc676e18-c895-4f6a-bce9-1f92207af885?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/bluesnap-payment-gateway-for-woocommerce/trunk/includes/class-wc-bluesnap-ipn-webhooks.php#L417"}, {"url": "https://plugins.trac.wordpress.org/browser/bluesnap-payment-gateway-for-woocommerce/tags/3.4.0/includes/class-wc-bluesnap-ipn-webhooks.php#L417"}], "descriptions": [{"lang": "en", "value": "The BlueSnap Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.4.0. This is due to the plugin relying on WooCommerce's `WC_Geolocation::get_ip_address()` function to validate IPN requests, which trusts user-controllable headers like X-Real-IP and X-Forwarded-For to determine the client IP address. This makes it possible for unauthenticated attackers to bypass IP allowlist restrictions by spoofing a whitelisted BlueSnap IP address and send forged IPN (Instant Payment Notification) data to manipulate order statuses (mark orders as paid, failed, refunded, or on-hold) without proper authorization."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:27:47.544Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0692", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:27:47.544Z", "dateReserved": "2026-01-07T20:56:45.998Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-14T04:35:43.208Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "BlueSnap Payment Gateway for WooCommerce", "vendor": "bluesnap", "versions": [{"lessThanOrEqual": "3.4.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The BlueSnap Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.4.0. This is due to the plugin relying on WooCommerce's `WC_Geolocation::get_ip_address()` function to validate IPN requests, which trusts user-controllable headers like X-Real-IP and X-Forwarded-For to determine the client IP address. This makes it possible for unauthenticated attackers to bypass IP allowlist restrictions by spoofing a whitelisted BlueSnap IP address and send forged IPN (Instant Payment Notification) data to manipulate order statuses (mark orders as paid, failed, refunded, or on-hold) without proper authorization."}, {"lang": "es", "value": "El plugin BlueSnap Payment Gateway para WooCommerce para WordPress es vulnerable a la Falta de autorizaci\u00f3n en todas las versiones hasta la 3.3.0, inclusive. Esto se debe a que el plugin se basa en la funci\u00f3n 'WC_Geolocation::get_ip_address()' de WooCommerce para validar las solicitudes IPN, la cual conf\u00eda en encabezados controlables por el usuario como X-Real-IP y X-Forwarded-For para determinar la direcci\u00f3n IP del cliente. Esto hace posible que atacantes no autenticados eludan las restricciones de la lista de permitidos de IP suplantando una direcci\u00f3n IP de BlueSnap en la lista blanca y env\u00eden datos IPN (Notificaci\u00f3n de Pago Instant\u00e1nea) falsificados para manipular estados de pedidos (marcar pedidos como pagados, fallidos, reembolsados o en espera) sin la autorizaci\u00f3n adecuada."}], "id": "CVE-2026-0692", "lastModified": "2026-06-17T10:11:12.927", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0692", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-18T18:47:41.524502Z", "version": "2.0.3"}}]}, "published": "2026-02-14T05:16:16.923", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/bluesnap-payment-gateway-for-woocommerce/tags/3.4.0/includes/class-wc-bluesnap-ipn-webhooks.php#L417"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/bluesnap-payment-gateway-for-woocommerce/trunk/includes/class-wc-bluesnap-ipn-webhooks.php#L417"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dc676e18-c895-4f6a-bce9-1f92207af885?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.3.0]"}}], "product": "payment_gateway_for_woocommerce", "vendor": "hblpay"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T18:31:52.674738+00:00", "value": {"mitigation_remediation": ["Update the BlueSnap Payment Gateway for WooCommerce plugin to the latest available version to address the missing authorization flaw.", "If an update is unavailable, consider disabling or restricting IPN processing or reconfiguring the plugin to reject requests that originate from non\u2011verified IP addresses, ensuring that user\u2011controlled headers are not trusted for authentication.", "Audit orders for suspicious status changes and correct any that may have been affected by unauthorized IPN requests.", "Configure your web server or network firewall to allow IPN traffic only from the official BlueSnap IP ranges and to strip X\u2011Real\u2011IP and X\u2011Forwarded\u2011For headers before they reach the application."], "summary": {"action": "Immediate Patch", "impact": "Unauthenticated manipulation of WooCommerce order status via forged IPN requests"}, "threat_synthesis": {"affected_systems": "WordPress sites that use the BlueSnap Payment Gateway for WooCommerce plugin version 3.4.0 or earlier, including all releases up to and including 3.4.0, operated by any merchant with an active BlueSnap integration.", "description_and_impact": "The BlueSnap Payment Gateway for WooCommerce plugin fails to enforce proper authorization when processing Instant Payment Notification (IPN) requests. It relies on a plugin\u2011level wrapper that accepts IP addresses derived from user\u2011controllable HTTP headers, allowing an unauthenticated attacker to spoof a legitimate BlueSnap IP address and send forged IPN payloads. By doing so, an attacker can arbitrarily alter order statuses\u2014including marking orders as paid, failed, refunded, or on\u2011hold\u2014without any legitimate credentials. This vulnerability enables unauthorized financial state changes that could have serious business and reputational repercussions.", "risk_and_exploitability": "The severity score of 7.5 indicates a high\u2011risk vulnerability, while the EPSS score of less than 1% suggests that, at the time of this assessment, the likelihood of public exploitation is low. The flaw is not listed in the CISA KEV catalog. Attackers would likely exploit the flaw remotely by sending forged IPN traffic that appears to originate from an approved BlueSnap IP address, bypassing the plugin's IP whitelisting logic and manipulating order states without authentication."}}}}, "created": "2026-02-16T12:03:14.174089+00:00", "updated": "2026-04-15T18:45:11.405644+00:00", "vendors": ["hblpay", "hblpay$PRODUCT$payment_gateway_for_woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}