CVE-2026-0692 Details.
BlueSnap Payment Gateway for WooCommerce <=3.4.0 - IPN Authorization Bypass
Atlas does not check this one. Needs requests that change data.
To test for this one, the check would have to send requests that could change data on the site. Atlas only ever reads public pages, so it does not run this check.
About CVE-2026-0692. What It Means.
BlueSnap Payment Gateway for WooCommerce <= 3.4.0 validates its unauthenticated IPN webhook using WooCommerce's client-IP geolocation, which trusts spoofed forwarding headers instead of requiring a webhook signature. Version 3.4.1 replaces the IP check with HMAC-SHA256 security headers. This detector supplies a generated, non-existent transaction ID, so the vulnerable code reaches the order lookup and returns `Order could not be found` without changing an order.
Affected Product. What Is Hit.
- Vendor
- bluesnap
- Product
- BlueSnap Payment Gateway For WooCommerce
References. Where To Read More.
- https://plugins.svn.wordpress.org/bluesnap-payment-gateway-for-woocommerce/tags/3.4.0/includes/class-wc-bluesnap-ipn-webhooks.php
- https://plugins.svn.wordpress.org/bluesnap-payment-gateway-for-woocommerce/tags/3.4.1/includes/class-wc-bluesnap-ipn-webhooks.php
- https://nvd.nist.gov/vuln/detail/CVE-2026-0692
FAQ
Common Questions.
BlueSnap Payment Gateway for WooCommerce <=3.4.0 - IPN Authorization Bypass. BlueSnap Payment Gateway for WooCommerce <= 3.4.0 validates its unauthenticated IPN webhook using WooCommerce's client-IP geolocation, which trusts spoofed forwarding headers instead of requiring a webhook signature. Version 3.4.1 replaces the IP check with HMAC-SHA256 security headers. This detector supplies a generated, non-existent transaction ID, so the vulnerable code reaches the order lookup and returns `Order could not be found` without changing an order.
No. To test for this one, the check would have to send requests that could change data on the site. Atlas only ever reads public pages, so it does not run this check. The facts about CVE-2026-0692 are on this page, and you can request a demo to see how Brandefense watches your whole external attack surface.
CVE-2026-0692 is not on the CISA Known Exploited Vulnerabilities list at the time of writing, but it is still worth fixing.
Update BlueSnap Payment Gateway For WooCommerce to the latest version from the vendor, or follow the vendor's advice to switch off the affected feature. Vendor links are listed on this page when they are known.
This page lists the public facts about CVE-2026-0692. Atlas does not run a check for it, so nothing here says whether a particular site is affected.