CVE-2026-87974
Asaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Order Payment Bypass via Webhook
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, accepting an empty access token in its default configuration and not verifying that the confirmed payment corresponds to the order it marks paid, allowing unauthenticated attackers to mark arbitrary orders as paid.
| Vendor | unknown |
| Product | asaas gateway for woocommerce |
| Published | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown asaas gateway for woocommerce
Be the first to know when new unknown vulnerabilities affecting unknown asaas gateway for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Asaas Gateway for WooCommerce
0 < 2.7.8
References
Credits
Guillermo Álvarez Fernández WPScan