---
id: "CVE-2026-123088"
page: "https://infrastack.ai/live/CVE-2026-123088"
kind: "vulnerability"
aliases: ["CVE-2026-123088"]
title: "UniPAY WooCommerce plugin leaks order keys and customer personal data"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "payments", "unipay", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-2.4-or-later"]
published_at: "2026-11-09T07:17:29+00:00"
first_seen_at: "2026-11-09T07:25:04+00:00"
updated_at: "2026-11-09T07:25:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123088", "first_seen_at": "2026-11-09T07:25:04+00:00"}]
exploit_sources: []
---

# UniPAY WooCommerce plugin leaks order keys and customer personal data

Link for people: https://infrastack.ai/live/CVE-2026-123088 (this .md is for agents)

The UniPAY Payment Gateway for WooCommerce WordPress plugin before 2.4 returns an order's order-received URL, including its secret key, for any order id without checking who is asking. An unauthenticated attacker can enumerate orders and read customers' names, email addresses, phone numbers and addresses.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed UniPAY Payment Gateway for WooCommerce plugin version in the WordPress admin under Plugins; unknown whether a specific version string applies beyond 'before 2.4'.
- Look for the plugin folder named after UniPAY in `wp-content/plugins/`.

## Fix

- UniPAY Payment Gateway for WooCommerce: `2.4` (the plugin is affected before this version).

## Timeline

- 2026-11-09T07:25:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123088

## From the sources

The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before returning an order's order-received URL for an attacker-supplied order id, exposing the order's secret key in the redirect and allowing unauthenticated attackers to enumerate orders and disclose customers' personal data (name, email address, phone number and address).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_