CVE-2026-0656 is a missing authorization vulnerability (CWE-862) in the iPaymu Payment Gateway for WooCommerce plugin for WordPress, affecting all versions up to 2.0.2. The vulnerability arises because the plugin does not validate webhook request authenticity through signature verification or origin checks in the 'check_ipaymu_response' function. This allows unauthenticated attackers to manipulate order payment status by sending crafted POST requests to the webhook endpoint and to enumerate order IDs and obtain valid order keys via GET requests, exposing customer order PII.

An attacker can mark WooCommerce orders as paid without making any payment, potentially leading to financial loss for merchants. The attacker can also enumerate order IDs and retrieve valid order keys, exposing sensitive customer information including names, addresses, and details of purchased products. There is no indication of availability impact. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, users should consider disabling the iPaymu Payment Gateway plugin or restricting access to the webhook endpoint to trusted sources if possible. Monitor vendor communications for updates and apply official patches once available.