CVE-2026-0656 is a critical security vulnerability classified under CWE-862 (Missing Authorization) affecting the iPaymu Payment Gateway plugin for WooCommerce on WordPress. The vulnerability exists in the 'check_ipaymu_response' function, which handles webhook callbacks from the payment gateway. The plugin fails to authenticate or authorize incoming webhook requests, lacking mechanisms such as signature verification or origin validation. Consequently, an unauthenticated attacker can send arbitrary POST requests to the webhook endpoint to mark WooCommerce orders as paid without any legitimate payment transaction. This can lead to financial fraud by tricking the system into fulfilling unpaid orders. Furthermore, the vulnerability allows attackers to enumerate order IDs and retrieve valid order keys via unauthenticated GET requests, exposing personally identifiable information (PII) of customers, including names, addresses, and details of purchased products. The vulnerability affects all versions up to and including 2.0.2 of the plugin. The CVSS v3.1 score is 8.2 (high severity), reflecting the ease of remote exploitation without authentication or user interaction, and the significant confidentiality impact due to exposure of customer data. No known exploits are currently reported in the wild, but the vulnerability presents a substantial risk to e-commerce operations relying on this payment gateway integration.

For European organizations using WooCommerce with the iPaymu Payment Gateway plugin, this vulnerability poses serious risks. Financially, attackers can fraudulently mark orders as paid, potentially causing revenue loss and inventory mismanagement. Operationally, businesses may fulfill orders without receiving payment, impacting supply chains and customer trust. The exposure of customer PII violates GDPR regulations, risking regulatory penalties and reputational damage. Data leakage of names, addresses, and purchase details can facilitate further targeted attacks such as phishing or identity theft. The vulnerability's remote and unauthenticated exploitability increases the likelihood of automated attacks, especially against smaller e-commerce sites with limited security monitoring. This can undermine consumer confidence in affected online stores and disrupt e-commerce activities across Europe.

To mitigate CVE-2026-0656, organizations should immediately update the iPaymu Payment Gateway plugin once a patched version is released. Until then, implement manual controls such as restricting access to the webhook endpoint by IP whitelisting to only trusted iPaymu servers. Introduce additional webhook request validation by verifying cryptographic signatures or tokens if supported by the payment gateway. Monitor WooCommerce order status changes for anomalies, such as sudden payment confirmations without corresponding payment gateway records. Limit exposure of order information by disabling or securing any unauthenticated GET endpoints that reveal order IDs or keys. Conduct regular audits of payment processing logs to detect suspicious activity. Educate staff to recognize and respond to potential fraudulent orders. Finally, consider deploying Web Application Firewalls (WAFs) with custom rules to block unauthorized webhook requests and scanning for this vulnerability in routine security assessments.