CVE-2026-84043: 
WordPress vulnerability analysis and mitigation

CVE-2026-84043 is an unauthenticated payment confirmation bypass vulnerability in the ePayco Payment Gateway for WooCommerce WordPress plugin. The flaw allows unauthenticated attackers to mark orders as paid without providing a valid gateway signature, effectively obtaining goods or services without legitimate payment. All plugin versions before 8.4.7 are affected. It was publicly disclosed on September 2, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium), assigned by WPScan (WPScan, Github Advisory).

The vulnerability is classified as CWE-345 (Insufficient Verification of Data Authenticity). The root cause is a PHP loose type comparison flaw: when the reference parameter is omitted from a payment confirmation request, the plugin never computes the expected gateway signature, leaving it as null. Because PHP's loose comparison (==) evaluates null equal to an empty string as true, the signature check passes even though no valid signature was submitted. An attacker can exploit this by sending two crafted unauthenticated HTTP GET requests to the WooCommerce API endpoint (?wc-api=wc_gateway_epayco) with a known order ID and amount but without the signature or reference parameters — the first request transitions the order to on-hold, and the second marks it as payment complete (WPScan).

Successful exploitation allows an unauthenticated attacker to fraudulently mark any WooCommerce order as paid without completing an actual payment transaction, enabling them to obtain goods or services at no cost. The integrity impact is limited to order status manipulation — there is no confidentiality breach or availability impact. Affected merchants using the ePayco gateway in live mode with a valid secret key configured are at risk of financial loss proportional to the value of orders that can be manipulated (WPScan, Github Advisory).

No public proof-of-concept exploit code has been observed in the wild, and there is no evidence of active exploitation at the time of disclosure. However, the attack is fully automatable and requires no authentication, privileges, or user interaction, making it trivially executable at scale. The EPSS score is approximately 0.114% (2nd percentile), indicating a low but non-zero probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (WPScan, Github Advisory).

1. Reconnaissance: Identify WordPress sites running WooCommerce with the ePayco Payment Gateway plugin enabled (versions before 8.4.7) using tools like WPScan or by browsing to the checkout page and observing the ePayco payment option.
2. Create a pending order: As a guest, complete the WooCommerce checkout process selecting ePayco as the payment method. Note the resulting order ID (N) and order total (T) displayed on the confirmation page.
3. Send first bypass request: Issue an unauthenticated HTTP GET request omitting the signature and reference parameters to transition the order from pending to on-hold:

   curl -s "https://victim.example/?wc-api=wc_gateway_epayco&order_id=N&confirmation=1&x_amount=T&x_cod_transaction_state=1&x_currency_code=COP"

4. Send second bypass request: Repeat the identical request. The plugin processes it a second time and transitions the order status to payment complete.
5. Obtain goods/services: The order is now marked as fully paid with no actual payment made and no valid gateway signature supplied, allowing the attacker to claim the associated goods or services (WPScan).

• Network: Repeated unauthenticated HTTP GET requests to /?wc-api=wc_gateway_epayco containing confirmation=1 and x_cod_transaction_state=1 parameters but lacking signature or reference parameters; multiple such requests originating from the same IP targeting different order IDs.
• Logs: Web server access logs showing pairs of requests to the ePayco WooCommerce API endpoint with missing signature/reference fields; WooCommerce order logs showing rapid status transitions from pending → on-hold → payment complete without corresponding ePayco transaction records.
• Application: WooCommerce orders marked as payment complete via ePayco with no matching transaction ID or payment record in the ePayco merchant dashboard; orders completed in unusually short timeframes (seconds apart).

Update the ePayco Payment Gateway for WooCommerce plugin to version 8.4.7 or later, which properly verifies the authenticity of payment confirmation requests before accepting them. As an interim measure, administrators can disable the ePayco payment gateway until the update is applied. Additionally, merchants should review recent orders for suspicious status transitions (pending → on-hold → complete in rapid succession without valid ePayco transaction records) and consider implementing server-side IP allowlisting for payment confirmation callbacks if ePayco provides fixed callback IP ranges (WPScan, Github Advisory).

The vulnerability was discovered and responsibly reported by security researcher Pedro Pinho and verified by WPScan. No significant broader media coverage or notable public commentary beyond the standard vulnerability disclosure channels has been observed at this time (WPScan).