ePayco plugin for WooCommerce < 8.4.7 — Unauthenticated Unauthorized Order Status Manipulation

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under ePayco plugin for WooCommerce.
• No admin access? Run a passive check of your site. It reads public files only.
• No account is needed to exploit this. Treat any exposed site on an affected version as at risk.

What to do

1. Update to version 8.4.7, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch ePayco plugin for WooCommerce to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Pedro Pinho.

The ePayco plugin for WooCommerce plugin for WordPress is vulnerable to Payment Bypass in all versions up to 8.4.7. This is due to missing mandatory signature verification in the payment confirmation callback handler, where the HMAC signature check was only computed under a conditional and could be bypassed by omitting required fields, and the check_ipn_response function unconditionally accepted all incoming requests with if(true). This makes it possible for unauthenticated attackers to mark arbitrary WooCommerce orders as paid by sending a crafted payment confirmation callback without a valid ePayco gateway signature.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Sep 2, 2026

   CVE published

   Severity medium, CVSS 5.3

2. Nov 13, 2026

   Record last updated