CVE-2026-15152

This vulnerability allows an unauthenticated attacker to send a forged payment notification webhook to a site, tricking the booking system into marking a transaction as paid without any actual payment occurring. The attacker sends a webhook payload directly to the plugin's handler endpoint, and the plugin accepts it without verifying three critical things: that the request actually came from the payment gateway, that the transaction belongs to this merchant account, and that the amount matches the original booking. The CVSS 5.3 score is misleading—it captures the easy exploitability (network-accessible, no authentication required, low complexity) but completely undersells the business impact. A site operator suffers real revenue loss when bookings are marked paid that were never paid for. The attacker gets free services or goods; the site gets reconcileable discrepancy, inventory contamination, and accounting fraud that may go undetected for months. The root cause is straightforward: the plugin received the webhook and updated the database without any server-side validation. The fix requires adding merchant ID verification (confirming the transaction is for your account), amount matching (confirming the payment equals what was booked), and signature verification if the gateway provides it. These aren't exotic security requirements—they're basic payment integration hygiene that the plugin simply omitted. What makes this worth attention beyond the individual CVE is the pattern. Payment gateway documentation reliably tells developers 'when you receive this webhook, update the booking to paid.' What it rarely states explicitly is 'before you do that, verify this notification is legitimate.' This documentation asymmetry creates a blind spot: developers follow the happy path, ship the feature, and the security check that was never documented as required is never implemented. The fix for this plugin is trivial. The systemic problem—webhook handlers that implicitly trust incoming notifications—is not.

Reviewed through automated stages and approved by a human before publication.