CVE-2026-103313: BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Return Handler
The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount, allowing an unauthenticated attacker who holds a single genuine low-value transaction to mark arbitrary higher-value orders as paid.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the BitPay Gateway for WooCommerce WordPress plugin through version 4.1.3 are affected. The exposed workflow is the payment return handler used to complete WooCommerce orders.
What does an attacker need to exploit it?
An attacker does not need authentication or user interaction, but must possess one genuine low-value transaction. They can use that transaction confirmation to mark arbitrary higher-value orders as paid.
What validation is missing?
The plugin does not bind the payment provider's transaction confirmation to the specific order being completed. It also does not verify that the confirmed transaction amount matches the order amount.