CVE-2018-20782
Description
The GloBee plugin before 1.1.2 for WooCommerce mishandles IPN messages.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: v1.0.1, v1.1.0, v1.1.1
- Range: <1.1.2
Patches
Vulnerability mechanics
Root cause
"Reliance on untrusted inputs (CWE-807) in the IPN callback function allows payment status spoofing without cryptographic verification."
Attack vector
An unauthenticated remote attacker sends a crafted HTTP POST request to the IPN callback endpoint with parameters `id`, `status` (set to `completed`), and `custom_payment_id` (set to the target order ID) [ref_id=1]. The plugin accepts these untrusted inputs without verifying their authenticity via HMAC or any cryptographic signature, allowing the attacker to spoof a payment-completed status for any order [ref_id=1]. No administrative rights or prior authentication are required.
Affected code
The vulnerable code resides in the `ipn_callback()` function of `src/Gateway.php` at line 374 [ref_id=1]. The plugin mishandles IPN messages by relying on untrusted inputs without cryptographic authentication.
What the fix does
The advisory does not include a patch diff, but the vendor released version 1.1.2 to address the issue [ref_id=1]. The fix would need to add cryptographic authentication (e.g., HMAC verification) to the IPN callback so that only legitimate GloBee server messages are accepted, and to validate that the payment status corresponds to a genuine transaction before updating the order.
Preconditions
- inputThe attacker must know the target order ID and have a valid GloBee payment ID (obtainable by initiating a checkout on the shop)
- authNo authentication or administrative privileges are required
- networkThe attacker must be able to send HTTP requests to the vulnerable IPN callback endpoint
Reproduction
1. Initiate a checkout on the vulnerable WooCommerce store and select GloBee cryptocurrency payment to obtain a payment link (e.g., `https://globee.com/en/payment-request/XXXXXXXXXXXXXXXXXXXXXX`). 2. Extract the payment ID from the link and note the order ID assigned by WooCommerce. 3. Send a POST request to the IPN callback endpoint with payload `id=
Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3- www.exploit-db.com/exploits/46414/mitreexploitx_refsource_EXPLOIT-DB
- github.com/GloBee-Official/woocommerce-payment-api-plugin/issues/3mitrex_refsource_MISC
- github.com/GloBee-Official/woocommerce-payment-api-plugin/pull/2mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.