CVE-2026-12966

CVE-2026-12966 is an IDOR vulnerability in a WooCommerce payment plugin that allows unauthenticated attackers to modify order payment status and attach fraudulent payment proof files. The vulnerability is not merely a data leak — it's a fraud-enabling vector at the exact point where financial deception becomes possible. The root cause is the gap between what WordPress makes easy and what security requires. AJAX handlers with `nopriv` callbacks announce their unauthenticated nature explicitly — the hook registration is visible, documented, and hard to miss. But ownership verification has no such scaffold. There's no `current_user_owns($order_id)` helper, no decorator pattern, no default behavior that forces developers to verify whether the currently-unauthenticated requester has rights to manipulate a given order. The developer had to actively reason their way into adding that check, while the framework actively scaffolded the dangerous path. WooCommerce's use of sequential integer IDs for orders makes exploitation trivial. An attacker doesn't need sophistication — they increment through order IDs and submit forged payment metadata. The IDs are enumerable, guessable, and carry no entropy. This isn't negligence in the sense of careless coding; it's the path of least resistance given the WooCommerce API surface. What elevates this beyond a typical IDOR is the payment-proof file attachment. An attacker can forge a 'payment sent' state and attach fraudulent proof files that become part of the order record — not just data leakage, but active evidence tampering with persistence. These files can become the merchant's primary evidence in chargeback disputes, propagating the corrupted state to payment processors and potentially courts. This also creates PCI DSS compliance implications. The plugin operates at the financial transaction boundary, modifying payment metadata and attaching files within the cardholder data environment. Merchants using this plugin may have their compliance posture compromised by code they never wrote. If you're running WooCommerce with any payment-adjacent plugin, audit your AJAX endpoints: verify that every handler accepting an order ID performs explicit ownership verification (`current_user_can('edit_shop_order', $order_id)` or equivalent), not just authentication. Check whether any plugin modifies payment status outside WooCommerce's canonical `payment_complete()` workflow — bypassing that workflow is a fraud-enabling pattern, not just a code quality issue. Review what files can be attached to order records and whether those attachments enter PCI-scoped systems.

Reviewed through automated stages and approved by a human before publication.