Asaas Gateway for WooCommerce < 2.7.8 — Unauthenticated Arbitrary Order Status Manipulation

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Asaas Gateway for WooCommerce.
• No admin access? Run a passive check of your site. It reads public files only.
• No account is needed to exploit this. Treat any exposed site on an affected version as at risk.

What to do

1. Update to version 2.7.8, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch Asaas Gateway for WooCommerce to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Guillermo Álvarez Fernández.

The Asaas Gateway for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all versions up to 2.7.8. This is due to missing enforcement of a non-empty access token in the webhook token validator (an empty configured token matched any empty request token) and the absence of server-side verification that the Asaas-confirmed payment corresponds to the order being completed. This makes it possible for unauthenticated attackers to mark arbitrary WooCommerce orders as paid without authentication, by sending a webhook request with an empty access token and a payment ID that does not correspond to the targeted order.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Timeline

1. Oct 14, 2026

   CVE published

   Severity medium, CVSS 5.3

2. Nov 13, 2026

   Record last updated