CVE-2026-123088 · Package
NO FIX YET · SEE WHAT TO DO
The UniPAY Payment Gateway for WooCommerce WordPress plugin before 2.4 returns an order's order-received URL, including its secret key, for any order id without checking who is asking. An unauthenticated attacker can enumerate orders and read customers' names, email addresses, phone numbers and addresses.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Stores running the UniPAY Payment Gateway for WooCommerce plugin on WordPress with WooCommerce before version 2.4 are exposed, since the flaw is in the order-received redirect the plugin serves to any visitor. Sites not using this plugin, or running 2.4 or later, are not affected. The sources do not say whether any non-default configuration is required.
Not affected if plugin-not-installed, version-2.4-or-later
Who cares payments, unipay, woocommerce, wordpress
wp-content/plugins/.2.4 (the plugin is affected before this version).The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before returning an order's order-received URL for an attacker-supplied order id, exposing the order's secret key in the redirect and allowing unauthenticated attackers to enumerate orders and disclose customers' personal data (name, email address, phone number and address).
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.