PayU CommercePro Plugin Security & Risk Analysis

wordpress.org/plugins/payu-india

CommercePro payment plugin by PayU Payment Gateway (India) for WooCommerce (tested from 5.3 to 9.8.1).

7K active installs v3.8.8 PHP 7.4+ WP 5.3+ Updated Jul 15, 2025
gatewaypaymentpayu
89
A · Safe
CVEs total3
Unpatched0
Last CVEJun 5, 2025
Safety Verdict

Is PayU CommercePro Plugin Safe to Use in 2026?

Generally Safe

Score 89/100

PayU CommercePro Plugin has a strong security track record. Known vulnerabilities have been patched promptly.

3 known CVEsLast CVE: Jun 5, 2025Updated 8mo ago
Risk Assessment

The "payu-india" plugin v3.8.9 exhibits a concerning security posture, primarily due to a significant number of unprotected entry points. With all 4 AJAX handlers and all 8 REST API routes lacking authentication checks, there is a substantial attack surface exposed to unauthenticated users. While taint analysis shows no critical or high severity flows, the presence of the `unserialize` function in the code, coupled with a high volume of external HTTP requests, could potentially be exploited if input is not rigorously validated. The plugin's vulnerability history, including 3 known CVEs (2 critical and 1 medium), with one critical vulnerability still unpatched, strongly suggests recurring security weaknesses. The common vulnerability types also highlight issues with authentication and input sanitization, which align with the findings in the static analysis.

Despite the critical security concerns related to unprotected entry points and the unpatched critical vulnerability, the plugin does demonstrate some positive security practices. The vast majority of output (98%) is properly escaped, and the SQL query usage shows a reasonable percentage (32%) utilizing prepared statements, which helps mitigate SQL injection risks. However, these strengths are overshadowed by the critical deficiencies in authentication and the unresolved security flaws from past vulnerabilities, making this version of the plugin a high risk for deployment.

Key Concerns

  • Unpatched critical CVE
  • All AJAX handlers lack auth checks
  • All REST API routes lack permission callbacks
  • Presence of unserialize function
  • Critical CVE found in history
  • Medium CVE found in history
Vulnerabilities
3

PayU CommercePro Plugin Security Vulnerabilities

CVEs by Year

1 CVE in 2024
2024
2 CVEs in 2025
2025
Patched Has unpatched

Severity Breakdown

Critical
2
Medium
1

3 total CVEs

CVE-2025-31022critical · 9.8Authentication Bypass Using an Alternate Path or Channel

PayU CommercePro Plugin <= 3.8.7 - Authentication Bypass

Jun 5, 2025 Patched in 3.8.8 (33d)
CVE-2024-12264critical · 9.8Improper Authentication

PayU CommercePro Plugin <= 3.8.3 - Unauthenticated Privilege Escalation

Jan 6, 2025 Patched in 3.8.4 (66d)
CVE-2024-27193medium · 6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

PayU India <= 3.8.8 - Reflected Cross-Site Scripting via type

Feb 26, 2024 Patched in 3.8.9 (751d)
Code Analysis
Analyzed Mar 16, 2026

PayU CommercePro Plugin Code Analysis

Dangerous Functions
2
Raw SQL Queries
26
12 prepared
Unescaped Output
12
482 escaped
Nonce Checks
4
Capability Checks
0
File Operations
0
External Requests
20
Bundled Libraries
0

Dangerous Functions Found

unserialize$order = unserialize($order);includes\class-payu-verify-payment.php:66
unserialize$order = unserialize($order);trunk\includes\class-payu-verify-payment.php:66

SQL Query Safety

32% prepared38 total queries

Output Escaping

98% escaped494 total outputs
Data Flows
All sanitized

Data Flow Analysis

2 flows
<payu-refund-process> (includes\payu-refund-process.php:0)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
12 unprotected

PayU CommercePro Plugin Attack Surface

Entry Points12
Unprotected12

AJAX Handlers 4

authwp_ajax_custom_buy_nowincludes\buy_now\buy-now-payu.php:150
noprivwp_ajax_custom_buy_nowincludes\buy_now\buy-now-payu.php:151
authwp_ajax_custom_buy_nowtrunk\includes\buy_now\buy-now-payu.php:150
noprivwp_ajax_custom_buy_nowtrunk\includes\buy_now\buy-now-payu.php:151

REST API Routes 8

GET/wp-json/payu/v1/get-payment-success-updateincludes\admin\payu-webhook-calls.php:32
GET/wp-json/payu/v1/get-payment-failed-updateincludes\admin\payu-webhook-calls.php:49
GET/wp-json/payu/v1/get-shipping-costincludes\class-payu-shipping-tax-api-calculation.php:23
POST/wp-json/payu/v1/refund-status-updateincludes\payu-refund-process.php:303
GET/wp-json/payu/v1/get-payment-success-updatetrunk\includes\admin\payu-webhook-calls.php:32
GET/wp-json/payu/v1/get-payment-failed-updatetrunk\includes\admin\payu-webhook-calls.php:49
GET/wp-json/payu/v1/get-shipping-costtrunk\includes\class-payu-shipping-tax-api-calculation.php:23
POST/wp-json/payu/v1/refund-status-updatetrunk\includes\payu-refund-process.php:303
WordPress Hooks 136
actionrest_api_initincludes\admin\payu-webhook-calls.php:13
actionrest_api_initincludes\admin\payu-webhook-calls.php:15
actionadmin_footerincludes\buy_now\buy-now-payu.php:20
actionwoocommerce_after_add_to_cart_buttonincludes\buy_now\buy-now-payu.php:99
actionwp_enqueue_scriptsincludes\buy_now\buy-now-payu.php:147
actionwpincludes\buy_now\buy-now-payu.php:304
actionwoocommerce_after_save_address_validationincludes\class-payu-account-address-sync.php:28
actionpass_arguments_to_save_addressincludes\class-payu-account-address-sync.php:29
actionpass_arguments_to_update_addressincludes\class-payu-account-address-sync.php:30
actionwoocommerce_created_customerincludes\class-payu-account-address-sync.php:31
actionwoocommerce_save_account_detailsincludes\class-payu-account-address-sync.php:32
filterwoocommerce_shipping_fieldsincludes\class-payu-account-address-sync.php:33
actionwp_loginincludes\class-payu-account-address-sync.php:34
actionwoocommerce_receipt_payubizincludes\class-payu-account-address-sync.php:35
filterwoocommerce_default_address_fieldsincludes\class-payu-account-address-sync.php:36
actionrest_api_initincludes\class-payu-shipping-tax-api-calculation.php:16
filtercron_schedulesincludes\class-payu-verify-payment.php:31
actioncheck_payment_status_after_every_five_minincludes\class-payu-verify-payment.php:34
actionpass_arguments_to_verifyincludes\class-payu-verify-payment.php:35
actionclear_scheduled_taskincludes\class-payu-verify-payment.php:36
actionwoocommerce_checkout_order_processedincludes\class-payu-verify-payment.php:39
actionwoocommerce_new_orderincludes\class-payu-verify-payment.php:40
actioninitincludes\class-wc-gateway-payu.php:71
actionwp_headincludes\class-wc-gateway-payu.php:72
actionvalid-payubiz-requestincludes\class-wc-gateway-payu.php:76
actionwoocommerce_receipt_payubizincludes\class-wc-gateway-payu.php:77
actionwoocommerce_update_options_payment_gatewaysincludes\class-wc-gateway-payu.php:83
filterwoocommerce_get_order_item_totalsincludes\payu-cart-express-checkout.php:31
filterwoocommerce_order_get_formatted_shipping_addressincludes\payu-cart-express-checkout.php:32
actionwoocommerce_pay_order_before_submitincludes\payu-cart-express-checkout.php:35
filterwoocommerce_coupons_enabledincludes\payu-cart-express-checkout.php:36
filterwoocommerce_product_needs_shippingincludes\payu-cart-express-checkout.php:37
actionwoocommerce_proceed_to_checkoutincludes\payu-cart-express-checkout.php:38
actionwoocommerce_widget_shopping_cart_buttonsincludes\payu-cart-express-checkout.php:39
actiontemplate_redirectincludes\payu-cart-express-checkout.php:40
actionwp_enqueue_scriptsincludes\payu-cart-express-checkout.php:41
filterwoocommerce_billing_fieldsincludes\payu-cart-express-checkout.php:42
filterwoocommerce_default_address_fieldsincludes\payu-cart-express-checkout.php:43
actionwoocommerce_before_cartincludes\payu-cart-express-checkout.php:44
actioninitincludes\payu-cart-express-checkout.php:46
actiontemplate_redirectincludes\payu-cart-express-checkout.php:47
actioninitincludes\payu-cart-express-checkout.php:48
actionwoocommerce_order_details_after_order_tableincludes\payu-refund-process.php:37
actionwoocommerce_order_item_meta_endincludes\payu-refund-process.php:40
actionwoocommerce_order_details_before_order_tableincludes\payu-refund-process.php:43
actionwoocommerce_order_details_before_order_tableincludes\payu-refund-process.php:49
actionwoocommerce_order_details_before_order_tableincludes\payu-refund-process.php:52
actionwoocommerce_order_details_before_order_tableincludes\payu-refund-process.php:55
actionrest_api_initincludes\payu-refund-process.php:58
actioninitincludes\payu-refund-process.php:60
filterwc_order_statusesincludes\payu-refund-process.php:61
filtercron_schedulesincludes\payu-refund-process.php:63
actionwpincludes\payu-refund-process.php:64
actionpayu_check_refund_status_check_next_scheduledincludes\payu-refund-process.php:65
actionadmin_footerincludes\payu_affordability_widget\payu-affordability-widget.php:16
actionwp_enqueue_scriptsincludes\payu_affordability_widget\payu-affordability-widget.php:143
actionwoocommerce_before_add_to_cart_formincludes\payu_affordability_widget\payu-affordability-widget.php:153
actionwoocommerce_before_cart_tableincludes\payu_affordability_widget\payu-affordability-widget.php:154
actionwoocommerce_review_order_before_paymentincludes\payu_affordability_widget\payu-affordability-widget.php:155
actionwoocommerce_blocks_loadedincludes\payu_affordability_widget\payu-affordability-widget.php:156
actionplugins_loadedindex.php:58
actionthe_contentindex.php:72
filterwoocommerce_payment_gatewaysindex.php:134
actionwp_enqueue_scriptsindex.php:189
actionbefore_woocommerce_initindex.php:196
actionwoocommerce_blocks_loadedindex.php:205
actionwoocommerce_blocks_payment_method_type_registrationindex.php:214
filterplugin_action_linksindex.php:235
actionrest_api_inittrunk\includes\admin\payu-webhook-calls.php:13
actionrest_api_inittrunk\includes\admin\payu-webhook-calls.php:15
actionadmin_footertrunk\includes\buy_now\buy-now-payu.php:20
actionwoocommerce_after_add_to_cart_buttontrunk\includes\buy_now\buy-now-payu.php:99
actionwp_enqueue_scriptstrunk\includes\buy_now\buy-now-payu.php:147
actionwptrunk\includes\buy_now\buy-now-payu.php:304
actionwoocommerce_after_save_address_validationtrunk\includes\class-payu-account-address-sync.php:28
actionpass_arguments_to_save_addresstrunk\includes\class-payu-account-address-sync.php:29
actionpass_arguments_to_update_addresstrunk\includes\class-payu-account-address-sync.php:30
actionwoocommerce_created_customertrunk\includes\class-payu-account-address-sync.php:31
actionwoocommerce_save_account_detailstrunk\includes\class-payu-account-address-sync.php:32
filterwoocommerce_shipping_fieldstrunk\includes\class-payu-account-address-sync.php:33
actionwp_logintrunk\includes\class-payu-account-address-sync.php:34
actionwoocommerce_receipt_payubiztrunk\includes\class-payu-account-address-sync.php:35
filterwoocommerce_default_address_fieldstrunk\includes\class-payu-account-address-sync.php:36
actionrest_api_inittrunk\includes\class-payu-shipping-tax-api-calculation.php:16
filtercron_schedulestrunk\includes\class-payu-verify-payment.php:31
actioncheck_payment_status_after_every_five_mintrunk\includes\class-payu-verify-payment.php:34
actionpass_arguments_to_verifytrunk\includes\class-payu-verify-payment.php:35
actionclear_scheduled_tasktrunk\includes\class-payu-verify-payment.php:36
actionwoocommerce_checkout_order_processedtrunk\includes\class-payu-verify-payment.php:39
actionwoocommerce_new_ordertrunk\includes\class-payu-verify-payment.php:40
actioninittrunk\includes\class-wc-gateway-payu.php:71
actionwp_headtrunk\includes\class-wc-gateway-payu.php:72
actionvalid-payubiz-requesttrunk\includes\class-wc-gateway-payu.php:76
actionwoocommerce_receipt_payubiztrunk\includes\class-wc-gateway-payu.php:77
actionwoocommerce_update_options_payment_gatewaystrunk\includes\class-wc-gateway-payu.php:83
filterwoocommerce_get_order_item_totalstrunk\includes\payu-cart-express-checkout.php:31
filterwoocommerce_order_get_formatted_shipping_addresstrunk\includes\payu-cart-express-checkout.php:32
actionwoocommerce_pay_order_before_submittrunk\includes\payu-cart-express-checkout.php:35
filterwoocommerce_coupons_enabledtrunk\includes\payu-cart-express-checkout.php:36
filterwoocommerce_product_needs_shippingtrunk\includes\payu-cart-express-checkout.php:37
actionwoocommerce_proceed_to_checkouttrunk\includes\payu-cart-express-checkout.php:38
actionwoocommerce_widget_shopping_cart_buttonstrunk\includes\payu-cart-express-checkout.php:39
actiontemplate_redirecttrunk\includes\payu-cart-express-checkout.php:40
actionwp_enqueue_scriptstrunk\includes\payu-cart-express-checkout.php:41
filterwoocommerce_billing_fieldstrunk\includes\payu-cart-express-checkout.php:42
filterwoocommerce_default_address_fieldstrunk\includes\payu-cart-express-checkout.php:43
actionwoocommerce_before_carttrunk\includes\payu-cart-express-checkout.php:44
actioninittrunk\includes\payu-cart-express-checkout.php:46
actiontemplate_redirecttrunk\includes\payu-cart-express-checkout.php:47
actioninittrunk\includes\payu-cart-express-checkout.php:48
actionwoocommerce_order_details_after_order_tabletrunk\includes\payu-refund-process.php:37
actionwoocommerce_order_item_meta_endtrunk\includes\payu-refund-process.php:40
actionwoocommerce_order_details_before_order_tabletrunk\includes\payu-refund-process.php:43
actionwoocommerce_order_details_before_order_tabletrunk\includes\payu-refund-process.php:49
actionwoocommerce_order_details_before_order_tabletrunk\includes\payu-refund-process.php:52
actionwoocommerce_order_details_before_order_tabletrunk\includes\payu-refund-process.php:55
actionrest_api_inittrunk\includes\payu-refund-process.php:58
actioninittrunk\includes\payu-refund-process.php:60
filterwc_order_statusestrunk\includes\payu-refund-process.php:61
filtercron_schedulestrunk\includes\payu-refund-process.php:63
actionwptrunk\includes\payu-refund-process.php:64
actionpayu_check_refund_status_check_next_scheduledtrunk\includes\payu-refund-process.php:65
actionadmin_footertrunk\includes\payu_affordability_widget\payu-affordability-widget.php:16
actionwp_enqueue_scriptstrunk\includes\payu_affordability_widget\payu-affordability-widget.php:143
actionwoocommerce_before_add_to_cart_formtrunk\includes\payu_affordability_widget\payu-affordability-widget.php:153
actionwoocommerce_before_cart_tabletrunk\includes\payu_affordability_widget\payu-affordability-widget.php:154
actionwoocommerce_review_order_before_paymenttrunk\includes\payu_affordability_widget\payu-affordability-widget.php:155
actionwoocommerce_blocks_loadedtrunk\includes\payu_affordability_widget\payu-affordability-widget.php:156
actionplugins_loadedtrunk\index.php:58
actionthe_contenttrunk\index.php:72
filterwoocommerce_payment_gatewaystrunk\index.php:134
actionwp_enqueue_scriptstrunk\index.php:189
actionbefore_woocommerce_inittrunk\index.php:196
actionwoocommerce_blocks_loadedtrunk\index.php:205
actionwoocommerce_blocks_payment_method_type_registrationtrunk\index.php:214
filterplugin_action_linkstrunk\index.php:235

Scheduled Events 6

pass_arguments_to_save_address
pass_arguments_to_verify
payu_check_refund_status_check_next_scheduled
pass_arguments_to_save_address
pass_arguments_to_verify
payu_check_refund_status_check_next_scheduled
Maintenance & Trust

PayU CommercePro Plugin Maintenance & Trust

Maintenance Signals

WordPress version tested6.8.5
Last updatedJul 15, 2025
PHP min version7.4
Downloads71K

Community Trust

Rating100/100
Number of ratings1
Active installs7K
Developer Profile

PayU CommercePro Plugin Developer Profile

PayU India

1 plugin · 7K total installs

71
trust score
Avg Security Score
89/100
Avg Patch Time
283 days
View full developer profile
Detection Fingerprints

How We Detect PayU CommercePro Plugin

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/payu-india/assets/js/custom-block-cart.js
Script Paths
/wp-content/plugins/payu-india/assets/js/custom-block-cart.js

HTML / DOM Fingerprints

CSS Classes
info-boxsuccess-boxerror-boxwarning-box
HTML Comments
Added File For Buy NowAdded by SMAdded File For Affordability WidgetAdded by SM+11 more
Data Attributes
data-payu-noncedata-payu-payid
JS Globals
payu_payment_params
REST Endpoints
/wp-json/payu-india/v1/process/wp-json/payu-india/v1/webhook
Shortcode Output
<div class="box -box"></div>
FAQ

Frequently Asked Questions about PayU CommercePro Plugin