CVE-2026-16738

This CVE exposes a WordPress payment plugin (Conekta integration) with three missing security controls in its webhook handler: webhook signature verification, order binding validation, and amount validation. The practical impact is severe—an unauthenticated attacker can send a crafted webhook that marks any order as paid, immediately triggering fulfillment and potentially shipping physical goods with zero actual payment. The CVSS 5.3 score badly misrepresents the actual risk. This is not a medium-severity information disclosure; it's a direct fraud mechanism requiring no authentication, no reconnaissance, and no exploit chaining. The only barrier is knowing an order ID, which in WordPress e-commerce is frequently exposed in email confirmations, browser history, or trivially enumerated. The CVSS framework was built for data breaches, not financial fraud—it treats this as a low-complexity attack with low availability impact when the reality is trivially executable fraud with immediate financial consequences. Critical insight: any ONE of the three missing controls would have blocked this attack. Webhook signature verification is the primary gate—without it, the attacker walks through an open door. Order binding and amount validation are secondary confirmations that become irrelevant once the gate is bypassed. The fix isn't adding three controls; it's adding the one that actually gates the attack. This vulnerability follows a documented pattern in WordPress payment plugins—different developers, different gateways, identical structural gap. Root causes vary: developers never conceived of signature verification, stripped it during API migrations and forgot to restore it, or implemented the happy path and deferred security hardening. All produce identical shipped code. For defenders: implement webhook HMAC verification as the immediate priority, then add order binding and amount validation as defense-in-depth. Treat security controls as live dependencies that can break silently when payment gateways update their APIs. The CVSS score will mislead you about urgency—this requires immediate patching.

Reviewed through automated stages and approved by a human before publication.