CVE-2026-56048: Unauthenticated IDOR in WooCommerce Payment Fees Plugin

Technical summary

CVE-2026-56048 is an Insecure Direct Object Reference (IDOR) vulnerability classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerability exists in Payment Gateway Based Fees and Discounts for WooCommerce versions up to and including 3.0.0. The affected functionality lacks proper authentication and authorization controls, permitting unauthenticated attackers to directly reference and modify fee and discount objects associated with payment gateway transactions. The attack vector is network-based with low complexity and requires no user interaction or privileges.

Business impact

This vulnerability creates financial exposure through unauthorized order manipulation. Attackers could reduce order totals by applying unintended discounts, eliminating fees, or modifying pricing structures without legitimate authorization. For e-commerce operations relying on this plugin, potential impacts include revenue loss, inventory accounting mismatches, and customer confusion regarding charged amounts. The ability to modify orders without detection could also facilitate fraud schemes or create audit trail gaps.

Affected systems

Payment Gateway Based Fees and Discounts for WooCommerce versions 3.0.0 and earlier are affected. Any WooCommerce installation using this plugin up to the vulnerable version is at risk. The vulnerability does not require specific configurations or advanced prerequisites—default installations are vulnerable.

Exploitability

The vulnerability has relatively low complexity to exploit. No authentication is required, and attacks can be launched over the network without user interaction. An attacker needs only to identify order or fee objects and craft requests to modify them directly. However, practical exploitation requires knowledge of order identifiers or fee structures within the target system, which may not be immediately obvious without reconnaissance.

Remediation

Administrators should update the Payment Gateway Based Fees and Discounts plugin to a version newer than 3.0.0. Verify against the vendor's official advisory to confirm the patched version number. Until a patch is applied, consider disabling the plugin if not operationally critical, or implement Web Application Firewall (WAF) rules to detect and block suspicious requests targeting fee and discount endpoints.

Patch guidance

Upgrade the Payment Gateway Based Fees and Discounts for WooCommerce plugin immediately. Check the WordPress plugin repository and vendor advisory pages for the latest available version. Standard WordPress plugin update mechanisms can be used. After updating, verify that fee and discount functionality continues to work as expected in a staging environment before deploying to production.

Detection guidance

Monitor for HTTP requests that directly reference fee or discount object identifiers without corresponding user authentication sessions. Look for POST or PUT requests to plugin-related endpoints that originate from unauthenticated sources. Web access logs should be reviewed for patterns of sequential or enumerated object ID attempts. Implement logging on order modification events and cross-reference against authenticated user actions to identify unauthorized changes.

Why prioritize this

Although classified as MEDIUM severity, this vulnerability warrants prompt remediation because it directly enables financial fraud and order tampering on e-commerce platforms. The combination of unauthenticated access, low exploitation complexity, and integrity impact on critical business transactions justifies prioritizing this above other medium-severity issues. Delay increases the window for exploitation and potential undetected financial loss.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects the following factors: Network attack vector and low complexity lower the barrier to exploitation; no authentication required increases accessibility; no confidentiality impact (C:N) because data isn't exposed; but integrity and availability impacts are present (I:L, A:L) due to the ability to modify fees, discounts, and potentially affect order processing. The attack does not propagate across security boundaries (S:U). This score appropriately represents a significant but not critical vulnerability.

Frequently asked questions