WooCommerce Square <= 5.5.0 - Missing Authorization to Unauthenticated Apple Pay Domain Registration
- ID
- WPSEC-2026-0306
- Plugin
- WooCommerce Square (woocommerce-square)
- Affected
- from 2.3.0 before 5.5.1
- Remediation
- Update to 5.5.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- WooCommerce Square on WPSec AttackSurface
- Fix released
- Published
Description
The WooCommerce Square plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the apple_pay_domain_registration() function in versions 2.3.0 up to, and including, 5.5.0. The function was hooked to 'init' whenever is_admin() was true and the request's page/tab/section query parameters named the Square settings screen, so it ran before any login check and could be reached through admin-ajax.php without authentication. It also let POST values override the stored gateway, digital wallet and hidden-wallet settings, and sent the request's Host header to Square as the domain to register. This makes it possible for unauthenticated attackers to make the site call Square's Apple Pay domain registration API with the merchant's access token, registering a domain of their choice where the web server passes arbitrary Host headers to WordPress, or to make the registration fail, which marks the store's domain as unregistered and hides the Apple Pay button on the storefront until an administrator reopens the Square settings screen.
References
- https://wpsec.com/vuln/WPSEC-2026-0306/
- https://plugins.svn.wordpress.org/woocommerce-square/tags/5.5.1/
- https://wordpress.org/plugins/woocommerce-square/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS