CVE-2026-84043 in ePayco Payment Gateway Plugin
Summary
by MITRE • 09/04/2026
The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signature.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in versions of the ePayco Payment Gateway for WooCommerce prior to version 8.4.7 represents a critical failure in authentication and integrity verification mechanisms within the plugin's payment processing logic. This flaw specifically affects how the system handles incoming callbacks or webhooks from the external payment gateway provider, ePayco. In standard secure payment integrations, it is imperative that any request claiming to update order status originates from the legitimate service provider and has not been tampered with during transit. The affected plugin fails to properly verify the authenticity of these confirmation requests by neglecting to validate cryptographic signatures or other integrity checks provided by the gateway. This omission creates a significant security gap where the application trusts external input without sufficient proof of its origin, violating fundamental principles of secure software design regarding trust boundaries and data validation.
From an operational perspective, this vulnerability allows unauthenticated attackers to manipulate order statuses within the WooCommerce environment. By crafting malicious HTTP requests that mimic legitimate payment confirmation messages from ePayco, an attacker can send these forged payloads directly to the plugin's endpoint without possessing valid credentials or a genuine signature generated by the payment provider. Upon receiving such a request, the vulnerable software processes it as if it were authentic and updates the corresponding WooCommerce order status to paid. This capability effectively bypasses the financial transaction process entirely, allowing an attacker to mark orders for goods or services as completed and paid without any actual money changing hands through the ePayco system.
The impact of this vulnerability is severe from both a business integrity standpoint and a potential security escalation perspective. For merchants using WooCommerce with this plugin, the immediate consequence is financial loss due to fraud, where customers receive products or digital goods without paying for them. Furthermore, manipulating order statuses can disrupt inventory management systems that rely on accurate sales data, leading to stock discrepancies and operational inefficiencies. Beyond direct financial theft, such vulnerabilities often serve as a foothold for more sophisticated attacks. If the application logic associated with paid orders triggers additional automated processes, such as granting access to restricted content or triggering API calls to other services, an attacker could exploit this state change to gain unauthorized access to sensitive data or further compromise the host server environment.
This issue aligns closely with Common Weakness Enumeration (CWE) categories related to authentication and integrity failures. Specifically, it falls under CWE-287 Improper Authentication, as the system fails to verify the identity of the sender before accepting a state-changing action. It also relates to CWE-345 Insufficient Verification of Data Authenticity, highlighting the lack of cryptographic validation for incoming data from external sources. In terms of offensive security frameworks like MITRE ATT&CK, this vulnerability facilitates techniques associated with Account Manipulation and potentially Defense Evasion if used to cover tracks or bypass logging mechanisms that assume only legitimate transactions result in status changes. The attack vector is typically classified as Network-based, requiring the attacker to have network connectivity to the vulnerable web application endpoint.
To mitigate this risk, immediate action must be taken by updating the ePayco Payment Gateway for WooCommerce plugin to version 8.4.7 or later, where these validation checks have been implemented correctly. Administrators should ensure that their WordPress environment is fully patched and that all plugins are kept up to date with security releases from their respective developers. In addition to patching, implementing a Web Application Firewall can provide an additional layer of defense by filtering out malformed requests or those lacking expected headers associated with legitimate gateway traffic. Monitoring server logs for unusual patterns in order status changes, particularly those occurring outside normal business hours or involving high-value orders without corresponding transaction IDs from the payment provider, is also recommended to detect potential exploitation attempts early.