CVE-2026-97259 in Pay with Vipps Plugin
Summary
by MITRE • 09/30/2026
Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The identified vulnerability represents a critical authorization bypass within the Pay with Vipps plugin for WordPress, specifically affecting versions ranging from initial releases up to version 6.2.4. This flaw stems from an insecure implementation of access control mechanisms where the application relies on user-controlled keys or identifiers to determine privilege levels and resource accessibility. In secure software architecture, authorization decisions must be enforced server-side based on verified session tokens, roles, and permissions rather than mutable client-supplied parameters that can be manipulated by an attacker. When a system allows end-users to supply their own keys for authentication or authorization checks without sufficient validation against the backend identity provider, it creates a pathway for privilege escalation and unauthorized access.
From a technical perspective, this vulnerability is classified under CWE-284 Improper Access Control, specifically manifesting as Authorization Bypass Through User-Controlled Key. The core issue lies in the failure to properly validate that the key provided by the user corresponds to an authorized session or administrative context within the WordPress environment. By manipulating these keys, a malicious actor can bypass standard security checks designed to restrict access to sensitive plugin settings, payment configurations, and customer data associated with Vipps transactions. This type of flaw is particularly dangerous because it exploits the trust relationship between the frontend interface and backend logic, allowing attackers to interact with administrative functions or view restricted information without possessing valid credentials for those specific actions.
The operational impact of this vulnerability is severe, as it compromises the integrity and confidentiality of e-commerce operations managed through WooCommerce. An attacker could potentially alter payment gateway configurations, redirect transaction funds, or access sensitive customer personal data protected by privacy regulations such as GDPR. Furthermore, since Vipps handles financial transactions, any manipulation of authorization logic could lead to fraudulent activities, chargeback abuse, or complete compromise of the merchant's store backend. The ability to bypass security levels means that even users with minimal privileges might gain administrative control over critical payment processing features, undermining the fundamental trust required for online commerce platforms.
This vulnerability aligns closely with MITRE ATT&CK technique T1078 Valid Accounts and potentially T1528 Steal Application Access Token if session tokens are derived from or related to these keys. The exploitation vector typically involves intercepting HTTP requests via a proxy tool, modifying the user-controlled key parameter in API calls or form submissions, and observing how the server responds without proper re-authentication checks. To mitigate this risk, developers must implement strict input validation ensuring that all authorization keys are generated by the system and bound to specific sessions rather than being freely supplied by users. Additionally, enforcing role-based access control (RBAC) at every endpoint is essential to ensure that only authorized roles can perform sensitive operations regardless of the parameters passed in requests.
Immediate remediation requires updating the Pay with Vipps for WooCommerce plugin to a version later than 6.2.4 where these authorization checks have been hardened. Until an update is applied, administrators should restrict access to the WordPress dashboard and API endpoints using web application firewalls that can detect anomalous patterns of key manipulation. It is also advisable to audit server logs for unusual activity related to Vipps transaction processing or configuration changes originating from unexpected IP addresses or user agents. Regular security audits focusing on authentication flows and session management practices will help prevent similar authorization bypass vulnerabilities in future development cycles, ensuring compliance with industry standards for secure software design.