CVE-2026-87974: Asaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Order Payment Bypass via Webhook
The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, accepting an empty access token in its default configuration and not verifying that the confirmed payment corresponds to the order it marks paid, allowing unauthenticated attackers to mark arbitrary orders as paid.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Asaas Gateway for WooCommerceto a version that resolves this vulnerability.Fixed in 2.7.8
Event History
Frequently Asked Questions
Which installations are exposed?
Installations using Asaas Gateway for WooCommerce versions before 2.7.8 are affected. The vulnerable behavior occurs in the default configuration because the webhook accepts an empty access token.
What does an attacker need to exploit this?
An attacker does not need authentication. They can exploit the payment webhook to mark arbitrary orders as paid because the plugin does not verify that a confirmed payment belongs to the order being updated.
How can I tell whether this may already have been exploited?
Review orders marked paid and compare them with their corresponding confirmed payments. Orders recorded as paid without a matching confirmed payment warrant investigation.