{"id":1931,"date":"2025-06-09T18:45:00","date_gmt":"2025-06-09T15:45:00","guid":{"rendered":"https:\/\/trustcrypt.com\/security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites\/"},"modified":"2025-06-09T18:45:00","modified_gmt":"2025-06-09T15:45:00","slug":"security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites","status":"publish","type":"post","link":"https:\/\/trustcrypt.com\/ar\/security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites\/","title":{"rendered":"Security Vulnerability in PayU Plugin Facilitates Account Takeover on 5,000 WordPress Sites"},"content":{"rendered":"

A critical vulnerability in the PayU CommercePro plugin has exposed thousands of WordPress sites to risks from unauthenticated attackers capable of hijacking user accounts. <\/p>\n

Vulnerability in Shipping Cost API Enables Account Hijacking<\/h3>\n

Discovered in version 3.8.5, the flaw is rooted in insecure logic within the \/payu\/v1\/get-shipping-cost<\/code> API route. Attackers can exploit this vulnerability to impersonate any registered user, including site administrators, without authentication.<\/p>\n

Tracked as CVE-2025-31022, the vulnerability results from improper handling in the update_cart_data()<\/code> function, which processes order and shipping details. This function accepts user IDs and sets session data without verifying user identity.<\/p>\n

The API call only checks for a valid token associated with a hardcoded email\u2014commerce.pro@payu.in\u2014allowing attackers to generate a valid token via another exposed endpoint, \/payu\/v1\/generate-user-token<\/code>. Armed with this token, an attacker can issue a malicious request to gain access to any existing user account.<\/p>\n

Exploitation Involves Chained API Calls and Hardcoded Email<\/h3>\n

The attack sequence consists of several key steps:<\/p>\n

1. Generate an authentication token using the hardcoded email.
\n2. Call the shipping cost API using the targeted user\u2019s email.
\n3. Trigger the vulnerable update_cart_data()<\/code> function.
\n4. Access the WordPress account of the user.<\/p>\n

Additionally, the plugin deletes temporary guest accounts it creates, enhancing stealth and enabling attackers to operate undetected after account takeover.<\/p>\n

No Patch Released After 30-Day Disclosure Window<\/h3>\n

Despite efforts for responsible disclosure, no patch has been made available by the vendor. <\/p>\n

Users of the PayU CommercePro plugin are strongly advised to deactivate and remove the plugin. Developers should conduct audits of public API endpoints and eliminate hardcoded credentials to mitigate similar vulnerabilities in future applications.<\/p>\n","protected":false},"excerpt":{"rendered":"

A critical vulnerability in the PayU CommercePro plugin has exposed thousands of WordPress sites to risks from unauthenticated attackers capable…<\/p>\n","protected":false},"author":1,"featured_media":1932,"comment_status":"open","ping_status":"closed","sticky":false,"template":"Default","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[28],"tags":[845,451,108],"class_list":["post-1931","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-attackers","tag-plugin","tag-vulnerability"],"acf":[],"yoast_head":"\nSecurity Vulnerability in PayU Plugin Facilitates Account Takeover on 5,000 WordPress Sites - Trustcrypt<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/trustcrypt.com\/ar\/security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites\/\" \/>\n<meta property=\"og:locale\" content=\"ar_AR\" \/>\n<meta property=\"og:locale:alternate\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Security Vulnerability in PayU Plugin Facilitates Account Takeover on 5,000 WordPress Sites\" \/>\n<meta property=\"og:description\" content=\"A critical vulnerability in the PayU CommercePro plugin has exposed thousands of WordPress sites to risks from unauthenticated attackers capable...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/trustcrypt.com\/ar\/security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites\/\" \/>\n<meta property=\"og:site_name\" content=\"Trustcrypt\" \/>\n<meta property=\"article:published_time\" content=\"2025-06-09T15:45:00+00:00\" \/>\n<meta name=\"author\" content=\"Trustscrypt\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u0643\u064f\u062a\u0628 \u0628\u0648\u0627\u0633\u0637\u0629\" \/>\n\t<meta name=\"twitter:data1\" content=\"Trustscrypt\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u0648\u0642\u062a \u0627\u0644\u0642\u0631\u0627\u0621\u0629 \u0627\u0644\u0645\u064f\u0642\u062f\u0651\u0631\" \/>\n\t<meta name=\"twitter:data2\" content=\"\u062f\u0642\u064a\u0642\u0629 \u0648\u0627\u062d\u062f\u0629\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/trustcrypt.com\/security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites\/\",\"url\":\"https:\/\/trustcrypt.com\/security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites\/\",\"name\":\"Security Vulnerability in PayU Plugin Facilitates Account Takeover on 5,000 WordPress Sites\",\"isPartOf\":{\"@id\":\"https:\/\/trustcrypt.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/trustcrypt.com\/security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/trustcrypt.com\/security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/trustcrypt.com\/wp-content\/uploads\/2025\/06\/security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites.webp\",\"datePublished\":\"2025-06-09T15:45:00+00:00\",\"author\":{\"@id\":\"https:\/\/trustcrypt.com\/#\/schema\/person\/469b1cf97b9f7ea4e4d7fa31689dfa9f\"},\"inLanguage\":\"ar\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/trustcrypt.com\/security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"ar\",\"@id\":\"https:\/\/trustcrypt.com\/security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites\/#primaryimage\",\"url\":\"https:\/\/trustcrypt.com\/wp-content\/uploads\/2025\/06\/security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites.webp\",\"contentUrl\":\"https:\/\/trustcrypt.com\/wp-content\/uploads\/2025\/06\/security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites.webp\",\"width\":1792,\"height\":1024,\"caption\":\"Security Vulnerability in PayU Plugin Facilitates Account Takeover on 5,000 WordPress Sites\"},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/trustcrypt.com\/#website\",\"url\":\"https:\/\/trustcrypt.com\/\",\"name\":\"Trustcrypt\",\"description\":\"\u0627\u0644\u0623\u0645\u0646 \u0647\u0648 \u0627\u0633\u0645\u0646\u0627 \u0627\u0644\u062b\u0627\u0646\u064a\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/trustcrypt.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"ar\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/trustcrypt.com\/#\/schema\/person\/469b1cf97b9f7ea4e4d7fa31689dfa9f\",\"name\":\"Trustscrypt\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"ar\",\"@id\":\"https:\/\/trustcrypt.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4c36ff3376565a0f4981e9397667feb08d5e09acacce32a52ea4a3f628e03692?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4c36ff3376565a0f4981e9397667feb08d5e09acacce32a52ea4a3f628e03692?s=96&d=mm&r=g\",\"caption\":\"Trustscrypt\"},\"sameAs\":[\"http:\/\/trustcrypt.com\"],\"url\":\"https:\/\/trustcrypt.com\/ar\/author\/trustscrypt\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Security Vulnerability in PayU Plugin Facilitates Account Takeover on 5,000 WordPress Sites - Trustcrypt","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/trustcrypt.com\/ar\/security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites\/","og_locale":"ar_AR","og_type":"article","og_title":"[:en]Security Vulnerability in PayU Plugin Facilitates Account Takeover on 5,000 WordPress Sites[:] - Trustcrypt","og_description":"A critical vulnerability in the PayU CommercePro plugin has exposed thousands of WordPress sites to risks from unauthenticated attackers capable...","og_url":"https:\/\/trustcrypt.com\/ar\/security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites\/","og_site_name":"Trustcrypt","article_published_time":"2025-06-09T15:45:00+00:00","author":"Trustscrypt","twitter_card":"summary_large_image","twitter_misc":{"\u0643\u064f\u062a\u0628 \u0628\u0648\u0627\u0633\u0637\u0629":"Trustscrypt","\u0648\u0642\u062a \u0627\u0644\u0642\u0631\u0627\u0621\u0629 \u0627\u0644\u0645\u064f\u0642\u062f\u0651\u0631":"\u062f\u0642\u064a\u0642\u0629 \u0648\u0627\u062d\u062f\u0629"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/trustcrypt.com\/security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites\/","url":"https:\/\/trustcrypt.com\/security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites\/","name":"Security Vulnerability in PayU Plugin Facilitates Account Takeover on 5,000 WordPress Sites","isPartOf":{"@id":"https:\/\/trustcrypt.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/trustcrypt.com\/security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites\/#primaryimage"},"image":{"@id":"https:\/\/trustcrypt.com\/security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites\/#primaryimage"},"thumbnailUrl":"https:\/\/trustcrypt.com\/wp-content\/uploads\/2025\/06\/security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites.webp","datePublished":"2025-06-09T15:45:00+00:00","author":{"@id":"https:\/\/trustcrypt.com\/#\/schema\/person\/469b1cf97b9f7ea4e4d7fa31689dfa9f"},"inLanguage":"ar","potentialAction":[{"@type":"ReadAction","target":["https:\/\/trustcrypt.com\/security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites\/"]}]},{"@type":"ImageObject","inLanguage":"ar","@id":"https:\/\/trustcrypt.com\/security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites\/#primaryimage","url":"https:\/\/trustcrypt.com\/wp-content\/uploads\/2025\/06\/security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites.webp","contentUrl":"https:\/\/trustcrypt.com\/wp-content\/uploads\/2025\/06\/security-vulnerability-in-payu-plugin-facilitates-account-takeover-on-5-000-wordpress-sites.webp","width":1792,"height":1024,"caption":"Security Vulnerability in PayU Plugin Facilitates Account Takeover on 5,000 WordPress Sites"},{"@type":"WebSite","@id":"https:\/\/trustcrypt.com\/#website","url":"https:\/\/trustcrypt.com\/","name":"Trustcrypt","description":"\u0627\u0644\u0623\u0645\u0646 \u0647\u0648 \u0627\u0633\u0645\u0646\u0627 \u0627\u0644\u062b\u0627\u0646\u064a","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/trustcrypt.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ar"},{"@type":"Person","@id":"https:\/\/trustcrypt.com\/#\/schema\/person\/469b1cf97b9f7ea4e4d7fa31689dfa9f","name":"Trustscrypt","image":{"@type":"ImageObject","inLanguage":"ar","@id":"https:\/\/trustcrypt.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4c36ff3376565a0f4981e9397667feb08d5e09acacce32a52ea4a3f628e03692?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4c36ff3376565a0f4981e9397667feb08d5e09acacce32a52ea4a3f628e03692?s=96&d=mm&r=g","caption":"Trustscrypt"},"sameAs":["http:\/\/trustcrypt.com"],"url":"https:\/\/trustcrypt.com\/ar\/author\/trustscrypt\/"}]}},"_links":{"self":[{"href":"https:\/\/trustcrypt.com\/ar\/wp-json\/wp\/v2\/posts\/1931","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/trustcrypt.com\/ar\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/trustcrypt.com\/ar\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/trustcrypt.com\/ar\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/trustcrypt.com\/ar\/wp-json\/wp\/v2\/comments?post=1931"}],"version-history":[{"count":0,"href":"https:\/\/trustcrypt.com\/ar\/wp-json\/wp\/v2\/posts\/1931\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/trustcrypt.com\/ar\/wp-json\/wp\/v2\/media\/1932"}],"wp:attachment":[{"href":"https:\/\/trustcrypt.com\/ar\/wp-json\/wp\/v2\/media?parent=1931"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/trustcrypt.com\/ar\/wp-json\/wp\/v2\/categories?post=1931"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/trustcrypt.com\/ar\/wp-json\/wp\/v2\/tags?post=1931"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}