{"id":"CVE-2026-123088","kind":"vulnerability","aliases":["CVE-2026-123088"],"related":[],"title":"UniPAY WooCommerce plugin leaks order keys and customer personal data","description":"The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before returning an order's order-received URL for an attacker-supplied order id, exposing the order's secret key in the redirect and allowing unauthenticated attackers to enumerate orders and disclose customers' personal data (name, email address, phone number and address).","summary":"The UniPAY Payment Gateway for WooCommerce WordPress plugin before 2.4 returns an order's order-received URL, including its secret key, for any order id without checking who is asking. An unauthenticated attacker can enumerate orders and read customers' names, email addresses, phone numbers and addresses.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","payments","unipay","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","version-2.4-or-later"],"how_to_check":"- Check the installed UniPAY Payment Gateway for WooCommerce plugin version in the WordPress admin under Plugins; unknown whether a specific version string applies beyond 'before 2.4'.\n- Look for the plugin folder named after UniPAY in `wp-content/plugins/`.","fix":"- UniPAY Payment Gateway for WooCommerce: `2.4` (the plugin is affected before this version).","status":"open","published_at":"2026-11-09T07:17:29+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","triaged_at":"2026-11-09T07:25:41+00:00","updated_at":"2026-11-09T07:25:41+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T07:25:41Z","model":"claude-haiku-5-5","output":{"fix":"- UniPAY Payment Gateway for WooCommerce: `2.4` (the plugin is affected before this version).","reach":"internet","title":"UniPAY WooCommerce plugin leaks order keys and customer personal data","impact":"medium","summary":"The UniPAY Payment Gateway for WooCommerce WordPress plugin before 2.4 returns an order's order-received URL, including its secret key, for any order id without checking who is asking. An unauthenticated attacker can enumerate orders and read customers' names, email addresses, phone numbers and addresses.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","unipay","payments"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated attackers read customer names, emails, phone numbers and addresses.","analyst_note":"Confirm the fixed version and any advisory details at the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-123088; sources give no CVSS or vendor advisory.","how_to_check":"- Check the installed UniPAY Payment Gateway for WooCommerce plugin version in the WordPress admin under Plugins; unknown whether a specific version string applies beyond 'before 2.4'.\n- Look for the plugin folder named after UniPAY in `wp-content/plugins/`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-2.4-or-later"],"who_is_affected":"Stores running the UniPAY Payment Gateway for WooCommerce plugin on WordPress with WooCommerce before version 2.4 are exposed, since the flaw is in the order-received redirect the plugin serves to any visitor. Sites not using this plugin, or running 2.4 or later, are not affected. The sources do not say whether any non-default configuration is required.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000806,"input_tokens":4572,"output_tokens":697,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123088':13A,16A '-2026':12A,15A '2.4':31B,78C 'address':64B,68B,124C,128C 'allow':111C 'ask':52B 'attack':55B,97C,113C 'attacker-suppli':96C 'author':83C 'check':49B,84C 'custom':8A,61B,119C 'cve':11A,14A 'data':10A,121C 'disclos':118C 'email':63B,123C 'enumer':57B,115C 'expos':101C 'gateway':25B,72C 'id':47B,100C 'includ':40B 'key':6A,43B,106C 'leak':4A 'name':62B,122C 'number':66B,126C 'order':5A,34B,37B,46B,58B,88C,91C,99C,103C,116C 'order-receiv':36B,90C 'packag':17B 'payment':18B,24B,71C 'perform':81C 'person':9A,120C 'phone':65B,125C 'plugin':3A,29B,76C 'read':60B 'receiv':38B,92C 'redirect':109C 'return':32B,86C 'secret':42B,105C 'suppli':98C 'unauthent':54B,112C 'unipay':1A,19B,23B,70C 'url':39B,93C 'without':48B 'woocommerc':2A,20B,27B,74C 'wordpress':21B,28B,75C","nicknames":[],"mitigations":[],"who_affected":"Stores running the UniPAY Payment Gateway for WooCommerce plugin on WordPress with WooCommerce before version 2.4 are exposed, since the flaw is in the order-received redirect the plugin serves to any visitor. Sites not using this plugin, or running 2.4 or later, are not affected. The sources do not say whether any non-default configuration is required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","payments","unipay","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-123088':13A,16A '-2026':12A,15A 'custom':8A 'cve':11A,14A 'data':10A 'key':6A 'leak':4A 'order':5A 'person':9A 'plugin':3A 'unipay':1A 'woocommerc':2A","search_b":"'2.4':31B 'address':64B,68B 'ask':52B 'attack':55B 'check':49B 'custom':61B 'email':63B 'enumer':57B 'gateway':25B 'id':47B 'includ':40B 'key':43B 'name':62B 'number':66B 'order':34B,37B,46B,58B 'order-receiv':36B 'packag':17B 'payment':18B,24B 'phone':65B 'plugin':29B 'read':60B 'receiv':38B 'return':32B 'secret':42B 'unauthent':54B 'unipay':19B,23B 'url':39B 'without':48B 'woocommerc':20B,27B 'wordpress':21B,28B","search_c":"'2.4':78C 'address':124C,128C 'allow':111C 'attack':97C,113C 'attacker-suppli':96C 'author':83C 'check':84C 'custom':119C 'data':121C 'disclos':118C 'email':123C 'enumer':115C 'expos':101C 'gateway':72C 'id':100C 'key':106C 'name':122C 'number':126C 'order':88C,91C,99C,103C,116C 'order-receiv':90C 'payment':71C 'perform':81C 'person':120C 'phone':125C 'plugin':76C 'receiv':92C 'redirect':109C 'return':86C 'secret':105C 'suppli':98C 'unauthent':112C 'unipay':70C 'url':93C 'woocommerc':74C 'wordpress':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T07:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123088","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123088","severity":null,"published_at":"2026-11-09T07:17:29+00:00","modified_at":"2026-11-09T07:17:29+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","fetched_at":"2026-11-09T07:25:04+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}