CVE-2026-0692

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The BlueSnap Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.4.0. This is due to the plugin relying on WooCommerce's `WC_Geolocation::get_ip_address()` function to validate IPN requests, which trusts user-controllable headers like X-Real-IP and X-Forwarded-For to determine the client IP address. This makes it possible for unauthenticated attackers to bypass IP allowlist restrictions by spoofing a whitelisted BlueSnap IP address and send forged IPN (Instant Payment Notification) data to manipulate order statuses (mark orders as paid, failed, refunded, or on-hold) without proper authorization.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Feb 14, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-06934.4The Allow HTML in Category Descriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via category descriptions in all v CVE-2026-06946.4The SearchWiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in search results in all versions up to, and CVE-2026-06955.4In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output CVE-2026-06966.5In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this cou CVE-2026-06977.2A flaw has been found in code-projects Intern Membership Management System 1.0. The impacted element is an unknown function of the file /int CVE-2026-06987.2A vulnerability has been found in code-projects Intern Membership Management System 1.0. This affects an unknown function of the file /inter CVE-2026-06997.2A vulnerability was found in code-projects Intern Membership Management System 1.0. This impacts an unknown function of the file /intern/adm CVE-2026-07009.8A vulnerability was determined in code-projects Intern Membership Management System 1.0. Affected is an unknown function of the file /intern CVE-2026-07017.2A vulnerability was identified in code-projects Intern Membership Management System 1.0. Affected by this vulnerability is an unknown functi CVE-2026-07027.5The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'fields' parameter in CVE-2026-07036.4The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xlwct CVE-2026-07049.1In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint. The field