The iPaymu Payment Gateway for WooCommerce plugin suffers from a Missing Authorization vulnerability (CWE-862) identified as CVE-2026-0656. The root cause lies in the 'check_ipaymu_response' function, which processes webhook callbacks from the payment gateway but does not validate the authenticity of incoming requests. Specifically, the plugin lacks signature verification or origin checks, allowing any external party to send POST requests to the webhook endpoint and manipulate order statuses. This enables attackers to mark orders as paid without actual payment, effectively committing fraud. Furthermore, the plugin exposes endpoints that allow enumeration of order IDs and retrieval of valid order keys via GET requests, leading to unauthorized disclosure of personally identifiable information (PII) such as customer names, addresses, and details of purchased products. The vulnerability affects all plugin versions up to 2.0.2. The CVSS v3.1 score of 8.2 reflects the high impact on confidentiality and integrity, with no required privileges or user interaction and network attack vector. Although no public exploits have been reported, the ease of exploitation and the sensitive nature of the data involved make this a critical concern for WooCommerce sites using iPaymu as a payment gateway.

For European organizations operating WooCommerce stores with the iPaymu Payment Gateway plugin, this vulnerability can lead to significant financial and reputational damage. Attackers can fraudulently mark orders as paid, resulting in loss of revenue and potential inventory mismanagement. The exposure of customer PII violates GDPR requirements, risking regulatory fines and legal consequences. The data leakage of names, addresses, and purchase details can also facilitate targeted phishing or identity theft attacks against customers. The integrity of order processing is compromised, undermining trust in e-commerce operations. Given the network-based exploitation and lack of authentication, attackers can remotely exploit this vulnerability without user interaction, increasing the risk of widespread abuse. The absence of known exploits in the wild does not diminish the urgency, as the vulnerability is straightforward to exploit once discovered.

Immediate mitigation steps include disabling the iPaymu Payment Gateway plugin until a patched version is available. If disabling is not feasible, organizations should implement network-level controls such as IP whitelisting to restrict access to the webhook endpoint only to trusted iPaymu IP addresses. Web application firewalls (WAFs) can be configured to detect and block anomalous POST requests to the webhook URL. Monitoring and alerting on unusual order status changes or sudden spikes in marked-as-paid orders can help detect exploitation attempts. Additionally, organizations should audit access logs for suspicious GET requests that enumerate order IDs and keys. Developers should prioritize releasing a patched plugin version that enforces signature verification and origin checks on webhook requests. Until then, encrypting sensitive data at rest and minimizing stored PII can reduce exposure. Finally, informing customers about potential data exposure and reinforcing security awareness can mitigate downstream risks.