WordPress Plugin Vulnerabilities

Asaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Order Payment Bypass via Webhook

Description

The plugin does not properly authenticate its payment webhook, accepting an empty access token in its default configuration and not verifying that the confirmed payment corresponds to the order it marks paid, allowing unauthenticated attackers to mark arbitrary orders as paid.

Proof of Concept

Affects Plugins

Plugin icon
woo-asaas
Fixed in 2.7.8

References

CVE
CVE-2026-87974

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Guillermo Álvarez Fernández
Submitter
Guillermo Álvarez Fernández
Verified
Yes
WPVDB ID
3f6338bf-9d0d-4718-aefb-51d13800cec1

Timeline

Publicly Published
2026-10-12 (about 2 days ago)
Added
2026-10-12 (about 1 day ago)
Last Updated
2026-10-12 (about 1 day ago)

Other

Published
Title
Published
2026-08-14
Title
Manual Image Crop < 1.15 - Subscriber+ Arbitrary Attachment Image Overwrite via IDOR
Published
2025-07-11
Title
Simple Link Directory < 14.8.1 - Authentication Bypass
Published
2024-12-03
Title
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Social Sites Login < 1.8 - Authentication Bypass via WordPress.com OAuth provider
Published
2026-06-22
Title
Tutor LMS < 3.9.13 - Subscriber+ Unauthorized Course Enrollment and Private Course Content Disclosure via Droip/Kirki Integration
Published
2022-06-20
Title
WP OAuth Server ( Login with WordPress ) < 4.0.1 - Authentication Bypass