In July 2023, a single HTTP header was enough to impersonate the administrator of a WooCommerce store. CVE-2023-28121, a flaw in the WooCommerce Payments plugin, set off one of the most intense attack campaigns ever measured against WordPress. Here is how it worked, how events unfolded, and what to do to confirm that a store was not compromised.
WooCommerce Payments, a plugin installed by default on many stores
WooCommerce Payments, since renamed WooPayments, is Woo's official payment solution. It is often offered during WooCommerce setup and processes credit cards directly. At the time, Wordfence estimated it was active on more than 600,000 sites. A critical flaw in a plugin like this exposes both the site's admin area and a payment flow.
| Item | Details |
|---|---|
| Identifier | CVE-2023-28121 |
| Type | Authentication bypass leading to privilege escalation |
| CVSS 3.1 score | 9.8 out of 10 (critical), vector AV:N/AC:L/PR:N/UI:N |
| Affected versions | 4.8.0 to 5.6.1 |
| Patched versions | 4.8.2, 4.9.1, 5.0.4, 5.1.3, 5.2.2, 5.3.1, 5.4.1, 5.5.2, 5.6.2 and later |
| Discovery | Michael Mazzolini (GoldNetwork), via HackerOne, on March 22, 2023 |
| Exploitation | Mass campaign starting July 14, 2023 (Wordfence) |
How it worked: a header that names the user
To understand the flaw, you need to know how WordPress decides who you are. On every request, an internal filter, determine_current_user, returns the ID of the current user, normally based on session cookies. WooCommerce Payments hooked into this filter a function tied to a payment feature (platform checkout).
As RCE Security described in its analysis of the patch, this function read an HTTP header, X-Wcpay-Platform-Checkout-User, and, if it contained a number, returned that ID as the current user, without checking any password, cookie or token. In other words, the header value was taken at face value. By sending ID 1, usually the first administrator account, the attacker was treated by WordPress as that administrator.
Wordfence summarized the marker shared by every attack: the header X-Wcpay-Platform-Checkout-User: 1, which made the request be treated as coming from an administrator. The fix was drastic: according to RCE Security, the call that registered this filter was removed and the file of the class involved was deleted.
An attack campaign of rare scale
The timeline is telling. The flaw was reported on March 22, 2023 by a researcher through Woo's bug bounty program. On March 23, Woo released a series of patched versions and, together with the WordPress.org plugins team, pushed an automatic update to affected sites. Yet the attacks only exploded almost four months later.
According to Wordfence, mass attacks began on July 14, 2023 and peaked on July 16 at 1.3 million attacks against 157,000 sites in a single day. Notably, the attackers did not strike at random: several days earlier, Wordfence saw a rise in requests looking for the readme.txt file in the wp-content/plugins/woocommerce-payments/ folder, a way to identify sites running the plugin and their version. It is a clear example of reconnaissance setting up a targeted attack.
| Indicator | Value or behavior | Source |
|---|---|---|
| Exploit header | X-Wcpay-Platform-Checkout-User: 1 | Wordfence |
| Prior reconnaissance | requests for readme.txt in the plugin's folder | Wordfence |
| Plugin dropped | WP Console (lets an administrator run code) | Wordfence |
| Accounts created | administrators with random alphanumeric usernames (e.g. ac9edbbe) | Wordfence |
| Main IPs | 194.169.175.93, 103.102.153.17, 79.137.202.106, etc. | Wordfence |
How to check that a store was not hit
As with any flaw that has already been exploited, updating does not undo an intrusion that happened before. If a store ran WooCommerce Payments 4.8.0 to 5.6.1 between April and July 2023, carry out the following checks.
1. Check the version and the accounts
- Under Plugins, confirm that WooCommerce Payments or WooPayments is on a patched version (5.6.2 or later for the 5.6 branch).
- Under Users, list the administrators. The attackers created accounts with random alphanumeric names: any administrator you do not recognize is suspect.
- With WP-CLI:
wp user list --role=administrator --fields=ID,user_login,user_registered.
2. Look for persistence and traces
- Unknown plugins, especially WP Console or any tool that can run code.
- Recent PHP files or uploaders in
wp-content/uploads, which should not contain any scripts. - In your hosting access logs, requests carrying the
X-Wcpay-Platform-Checkout-Userheader or coming from the IP addresses Wordfence published for the period in question. - An integrity check of the core files and a server-side malware scan.
3. If you have doubts about payments
Woo stated that it had no evidence of exploitation outside its own testing program and did not believe that any store or customer data had been compromised, while adding that it would contact merchants by email if needed. As a precaution, Woo recommends the following if you see suspicious activity:
- reset administrator passwords, especially if they are reused elsewhere;
- regenerate API keys, including WooCommerce REST API keys, and payment gateway secrets stored in the database;
- regenerate the keys and salts in
wp-config.phpto invalidate open sessions; - contact Woo support if the store appears to be affected.
E-commerce remains a steady target
WooCommerce Payments is only one example. Payment and customer management plugins concentrate money and personal data, so they remain a prime target. In 2026, Wordfence documented an active campaign against another plugin in the WooCommerce ecosystem, WooCommerce Wholesale Lead Capture (CVE-2026-27540), an unauthenticated arbitrary file upload fixed in version 2.0.3.2. Wordfence reports blocking more than 100,000 attempts, often aimed at dropping PHP backdoors, and here too followed by the creation of administrator accounts.
The pattern is simple: on a store, every payment, shipping or account management plugin widens the attack surface. Two habits limit the risk:
- turn on automatic updates for the store's critical plugins, or at the very least apply them within 24 to 48 hours;
- keep an eye on the list of administrators and on the
uploadsfolder, which give away most post-exploitation compromises.
What WP Masquerade changes (and what it does not)
To be clear: no camouflage plugin fixes a flaw like CVE-2023-28121. Only updating protected you. However, the July 2023 campaign highlights a stage where WP Masquerade does play a role: reconnaissance. The attackers first looked for the plugin's readme.txt to find targets.
- WP Masquerade makes the files of its own plugins invisible to scanners on Apache and LiteSpeed; this file-hiding approach reduces the information a scanner can gather about a site, without replacing updates of third-party plugins;
- the bot traps count requests to sensitive URLs or to files that attack bots look for, an early signal when a scanning campaign starts; Pro adds a log and automatic banning;
- email alerts (Pro) warn you of abnormal activity; vulnerable plugin alerts (Pro) flag every known flaw in an installed plugin or theme, explain what it allows and give the patched version.
Key takeaways
- CVE-2023-28121 let anyone impersonate a store administrator through the X-Wcpay-Platform-Checkout-User header.
- Affected versions: WooCommerce Payments 4.8.0 to 5.6.1; fixed as of the 5.6.2 branch.
- The July 2023 campaign peaked at 1.3 million attacks in one day, after a reconnaissance phase using readme.txt.
- Check the version, unknown administrators, the WP Console plugin and the uploads folder.
- If in doubt, regenerate passwords, API keys and the wp-config.php salts.
Sources
- NVD: CVE-2023-28121 (opens in a new tab)
- WooCommerce: Critical Vulnerability Detected in WooCommerce Payments, What You Need to Know (opens in a new tab)
Other sources consulted: security research publications, trade press articles and Wordfence database.
