CVE-2026-87974 in Asaas Gateway for WooCommerce Plugin
Summary
by MITRE • 10/15/2026
The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, accepting an empty access token in its default configuration and not verifying that the confirmed payment corresponds to the order it marks paid, allowing unauthenticated attackers to mark arbitrary orders as paid.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified within the Asaas Gateway for WooCommerce WordPress plugin prior to version 2.7.8 represents a critical failure in authentication logic and data integrity verification during financial transaction processing. This flaw specifically affects the webhook endpoint responsible for receiving asynchronous payment notifications from the external payment processor, Asaas. In standard e-commerce architectures, webhooks serve as a secure communication channel between third-party services and the application backend to update order statuses based on real-time events such as successful payments or refunds. The security model relies heavily on verifying that these incoming requests originate from legitimate sources and contain valid credentials to prevent unauthorized state changes within the database.
The core technical flaw lies in the plugin's handling of access tokens during webhook validation. In its default configuration, the application accepts an empty string for the required access token parameter without triggering a rejection or error response. This behavior indicates that the authentication check is either bypassed entirely when the field is null or improperly implemented such that it evaluates to true against an empty value. Consequently, any actor capable of sending HTTP POST requests to this specific endpoint can interact with the payment processing logic without possessing valid API credentials issued by Asaas. This effectively removes the primary barrier designed to ensure that only authorized financial events influence the state of customer orders within the WooCommerce environment.
Beyond the authentication bypass, there is a significant lack of integrity verification regarding the mapping between webhook data and existing database records. The plugin fails to rigorously verify that the payment details contained in the webhook payload correspond accurately to an active order pending confirmation. This omission allows attackers to manipulate the input parameters associated with the transaction identifier or order reference. By crafting malicious requests, an unauthenticated attacker can specify arbitrary order IDs within the webhook data. Since the system does not cross-reference these identifiers against a validated list of transactions initiated by legitimate customers through Asaas, it proceeds to update the status of any specified order as paid regardless of whether a real transaction occurred or if the financial instrument was actually settled.
The operational impact of this vulnerability is severe and directly compromises the integrity of the e-commerce platform's revenue stream. Attackers can exploit this flaw to mark arbitrary orders as completed without making actual payments, effectively stealing goods or services from merchants who rely on automated fulfillment processes triggered by order completion status changes. This leads to direct financial loss through inventory depletion and potential reputational damage due to unfulfilled customer expectations. Furthermore, if the platform integrates with shipping providers that automatically dispatch items upon payment confirmation, this vulnerability could result in significant logistical costs and fraud-related complications for the business operator.
From a classification perspective, this issue aligns closely with CWE-287, which describes Improper Authentication, as the system fails to adequately verify the identity of an actor attempting to access resources or perform actions. Additionally, it relates to CWE-345, Insufficient Verification of Data Authenticity, because the application does not ensure that the data received from the webhook corresponds to a legitimate transaction context. In terms of offensive security frameworks such as MITRE ATT&CK, this vulnerability facilitates techniques associated with Account Manipulation and potentially Financial Fraud, allowing adversaries to alter system state for malicious gain without detection through standard access controls.
Mitigation strategies must prioritize immediate patching and defensive configuration adjustments. The most effective remediation is upgrading the Asaas Gateway plugin to version 2.7.8 or later, where these authentication checks have been corrected to reject empty tokens and enforce strict validation of order-to-payment mappings. Until an update can be applied, administrators should consider implementing network-level controls such as IP whitelisting for webhook endpoints if possible, restricting access only to known Asaas server addresses. Additionally, enabling web application firewall rules that detect anomalous patterns in POST requests targeting payment-related URLs can provide a layer of defense against exploitation attempts while the underlying code vulnerability remains unpatched. Regular auditing of order logs and reconciliation with external payment processor records is also recommended to identify any potential past exploitation activities resulting from this flaw.