{
    "title": "WooCommerce Payments CVE-2023-28121: the header that unlocked the admin",
    "seo_title": "WooCommerce Payments CVE-2023-28121 explained",
    "h1": "WooCommerce Payments CVE-2023-28121: the header that unlocked the admin",
    "description": "CVE-2023-28121: one HTTP header let attackers impersonate a WooCommerce store admin. How it worked, the timeline, and what to check.",
    "lead": "A single HTTP header was enough to take over a WooCommerce store. A look back at CVE-2023-28121, the attack campaign that followed, and the checks to run.",
    "language": "en",
    "locale": "en-US",
    "type": "article",
    "url": "https://www.wp-masquerade.com/woocommerce-payments-cve-2023-28121-explained/",
    "canonical": "https://www.wp-masquerade.com/woocommerce-payments-cve-2023-28121-explained/",
    "markdown": "https://www.wp-masquerade.com/woocommerce-payments-cve-2023-28121-explained/index.md",
    "json": "https://www.wp-masquerade.com/woocommerce-payments-cve-2023-28121-explained/index.json",
    "published": "2026-09-21T07:00:00+00:00",
    "modified": "2026-10-28T22:59:19+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "WooCommerce Payments CVE-2023-28121: the header that unlocked the admin",
            "url": "https://www.wp-masquerade.com/woocommerce-payments-cve-2023-28121-explained/",
            "markdown": "https://www.wp-masquerade.com/woocommerce-payments-cve-2023-28121-explained/index.md",
            "json": "https://www.wp-masquerade.com/woocommerce-payments-cve-2023-28121-explained/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "WooCommerce Payments CVE-2023-28121 : l’en-tête qui ouvrait l’administration",
            "url": "https://www.wp-masquerade.com/fr/woocommerce-payments-cve-2023-28121/",
            "markdown": "https://www.wp-masquerade.com/fr/woocommerce-payments-cve-2023-28121/index.md",
            "json": "https://www.wp-masquerade.com/fr/woocommerce-payments-cve-2023-28121/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "WooCommerce Payments CVE-2023-28121: la cabecera que abría la administración",
            "url": "https://www.wp-masquerade.com/es/woocommerce-payments-cve-2023-28121-cabecera/",
            "markdown": "https://www.wp-masquerade.com/es/woocommerce-payments-cve-2023-28121-cabecera/index.md",
            "json": "https://www.wp-masquerade.com/es/woocommerce-payments-cve-2023-28121-cabecera/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "WooCommerce Payments CVE-2023-28121: der Header, der den Adminbereich öffnete",
            "url": "https://www.wp-masquerade.com/de/woocommerce-payments-cve-2023-28121-header-luecke/",
            "markdown": "https://www.wp-masquerade.com/de/woocommerce-payments-cve-2023-28121-header-luecke/index.md",
            "json": "https://www.wp-masquerade.com/de/woocommerce-payments-cve-2023-28121-header-luecke/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "WooCommerce Payments CVE-2023-28121: l’intestazione che apriva l’amministrazione",
            "url": "https://www.wp-masquerade.com/it/woocommerce-payments-cve-2023-28121-spiegata/",
            "markdown": "https://www.wp-masquerade.com/it/woocommerce-payments-cve-2023-28121-spiegata/index.md",
            "json": "https://www.wp-masquerade.com/it/woocommerce-payments-cve-2023-28121-spiegata/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "WooCommerce Payments CVE-2023-28121: o cabeçalho que abria a administração",
            "url": "https://www.wp-masquerade.com/pt/woocommerce-payments-cve-2023-28121-cabecalho/",
            "markdown": "https://www.wp-masquerade.com/pt/woocommerce-payments-cve-2023-28121-cabecalho/index.md",
            "json": "https://www.wp-masquerade.com/pt/woocommerce-payments-cve-2023-28121-cabecalho/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "WooCommerce Payments CVE-2023-28121: de header die het beheer openzette",
            "url": "https://www.wp-masquerade.com/nl/woocommerce-payments-cve-2023-28121-header-lek/",
            "markdown": "https://www.wp-masquerade.com/nl/woocommerce-payments-cve-2023-28121-header-lek/index.md",
            "json": "https://www.wp-masquerade.com/nl/woocommerce-payments-cve-2023-28121-header-lek/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "WooCommerce Payments CVE-2023-28121: the header that unlocked the admin"
        },
        {
            "level": 2,
            "text": "WooCommerce Payments, a plugin installed by default on many stores"
        },
        {
            "level": 2,
            "text": "How it worked: a header that names the user"
        },
        {
            "level": 2,
            "text": "An attack campaign of rare scale"
        },
        {
            "level": 2,
            "text": "How to check that a store was not hit"
        },
        {
            "level": 3,
            "text": "1. Check the version and the accounts"
        },
        {
            "level": 3,
            "text": "2. Look for persistence and traces"
        },
        {
            "level": 3,
            "text": "3. If you have doubts about payments"
        },
        {
            "level": 2,
            "text": "E-commerce remains a steady target"
        },
        {
            "level": 2,
            "text": "What WP Masquerade changes (and what it does not)"
        },
        {
            "level": 3,
            "text": "Key takeaways"
        },
        {
            "level": 2,
            "text": "Sources"
        },
        {
            "level": 2,
            "text": "WordPress security, without the noise",
            "id": "wpm-nl-box-title"
        }
    ],
    "body": "In July 2023, a single HTTP header was enough to impersonate the administrator of a WooCommerce store. CVE-2023-28121, a flaw in the WooCommerce Payments plugin, set off one of the most intense attack campaigns ever measured against WordPress. Here is how it worked, how events unfolded, and what to do to confirm that a store was not compromised.\n\n## WooCommerce Payments, a plugin installed by default on many stores\n\nWooCommerce Payments, since renamed WooPayments, is Woo's official payment solution. It is often offered during WooCommerce setup and processes credit cards directly. At the time, Wordfence estimated it was active on more than 600,000 sites. A critical flaw in a plugin like this exposes both the site's admin area and a payment flow.\n\n| Item | Details |\n| --- | --- |\n| Identifier | CVE-2023-28121 |\n| Type | Authentication bypass leading to privilege escalation |\n| CVSS 3.1 score | 9.8 out of 10 (critical), vector AV:N/AC:L/PR:N/UI:N |\n| Affected versions | 4.8.0 to 5.6.1 |\n| Patched versions | 4.8.2, 4.9.1, 5.0.4, 5.1.3, 5.2.2, 5.3.1, 5.4.1, 5.5.2, 5.6.2 and later |\n| Discovery | Michael Mazzolini (GoldNetwork), via HackerOne, on March 22, 2023 |\n| Exploitation | Mass campaign starting July 14, 2023 (Wordfence) |\n\n*CVE-2023-28121 at a glance (sources: NVD, WooCommerce, Wordfence)*\n\n## How it worked: a header that names the user\n\nTo understand the flaw, you need to know how WordPress decides who you are. On every request, an internal filter, `determine_current_user`, returns the ID of the current user, normally based on session cookies. WooCommerce Payments hooked into this filter a function tied to a payment feature (`platform checkout`).\n\nAs RCE Security described in its analysis of the patch, this function read an HTTP header, `X-Wcpay-Platform-Checkout-User`, and, if it contained a number, returned that ID as the current user, without checking any password, cookie or token. In other words, the header value was taken at face value. By sending ID 1, usually the first administrator account, the attacker was treated by WordPress as that administrator.\n\n![Three-block diagram: an anonymous request carrying an HTTP header, the plugin's filter returning the requested user ID without any check, then WordPress handling the request as if it came from the administrator](https://www.wp-masquerade.com/media/2026/10/en-tete-en.webp)\n\n*The filter returned whatever user ID the header specified, with no authentication check at all.*\n\nWordfence summarized the marker shared by every attack: the header `X-Wcpay-Platform-Checkout-User: 1`, which made the request be treated as coming from an administrator. The fix was drastic: according to RCE Security, the call that registered this filter was removed and the file of the class involved was deleted.\n\n## An attack campaign of rare scale\n\n![Timeline from March to September 2023: report, patch and forced automatic update, then a mass attack campaign in July](https://www.wp-masquerade.com/media/2026/10/chronologie-en-3.webp)\n\n*Between the March patch and the July campaign, sites that had not updated remained exposed.*\n\nThe timeline is telling. The flaw was reported on March 22, 2023 by a researcher through Woo's bug bounty program. On March 23, Woo released a series of patched versions and, together with the WordPress.org plugins team, pushed an automatic update to affected sites. Yet the attacks only exploded almost four months later.\n\nAccording to Wordfence, mass attacks began on July 14, 2023 and peaked on July 16 at 1.3 million attacks against 157,000 sites in a single day. Notably, the attackers did not strike at random: several days earlier, Wordfence saw a rise in requests looking for the `readme.txt` file in the `wp-content/plugins/woocommerce-payments/` folder, a way to identify sites running the plugin and their version. It is a clear example of reconnaissance setting up a targeted attack.\n\n| Indicator | Value or behavior | Source |\n| --- | --- | --- |\n| Exploit header | X-Wcpay-Platform-Checkout-User: 1 | Wordfence |\n| Prior reconnaissance | requests for readme.txt in the plugin's folder | Wordfence |\n| Plugin dropped | WP Console (lets an administrator run code) | Wordfence |\n| Accounts created | administrators with random alphanumeric usernames (e.g. ac9edbbe) | Wordfence |\n| Main IPs | 194.169.175.93, 103.102.153.17, 79.137.202.106, etc. | Wordfence |\n\n*Indicators of compromise published by Wordfence in July 2023*\n\n## How to check that a store was not hit\n\nAs with any flaw that has already been exploited, updating does not undo an intrusion that happened before. If a store ran WooCommerce Payments 4.8.0 to 5.6.1 between April and July 2023, carry out the following checks.\n\n### 1. Check the version and the accounts\n\n- Under **Plugins**, confirm that WooCommerce Payments or WooPayments is on a patched version (5.6.2 or later for the 5.6 branch).\n- Under **Users**, list the administrators. The attackers created accounts with random alphanumeric names: any administrator you do not recognize is suspect.\n- With [WP-CLI](https://www.wp-masquerade.com/glossary/wp-cli/): `wp user list --role=administrator --fields=ID,user_login,user_registered`.\n\n### 2. Look for persistence and traces\n\n- Unknown plugins, especially **WP Console** or any tool that can run code.\n- Recent PHP files or uploaders in `wp-content/uploads`, which should not contain any scripts.\n- In your hosting access logs, requests carrying the `X-Wcpay-Platform-Checkout-User` header or coming from the IP addresses Wordfence published for the period in question.\n- An integrity check of the core files and a server-side malware scan.\n\n### 3. If you have doubts about payments\n\nWoo stated that it had no evidence of exploitation outside its own testing program and did not believe that any store or customer data had been compromised, while adding that it would contact merchants by email if needed. As a precaution, Woo recommends the following if you see suspicious activity:\n\n- reset administrator passwords, especially if they are reused elsewhere;\n- regenerate API keys, including WooCommerce REST API keys, and payment gateway secrets stored in the database;\n- regenerate the keys and salts in `wp-config.php` to invalidate open sessions;\n- contact Woo support if the store appears to be affected.\n\n## E-commerce remains a steady target\n\nWooCommerce Payments is only one example. Payment and customer management plugins concentrate money and personal data, so they remain a prime target. In 2026, Wordfence documented an active campaign against another plugin in the WooCommerce ecosystem, WooCommerce Wholesale Lead Capture (CVE-2026-27540), an unauthenticated arbitrary file upload fixed in version 2.0.3.2. Wordfence reports blocking more than 100,000 attempts, often aimed at dropping PHP backdoors, and here too followed by the creation of administrator accounts.\n\nThe pattern is simple: on a store, every payment, shipping or account management plugin widens the attack surface. Two habits limit the risk:\n\n1. turn on automatic updates for the store's critical plugins, or at the very least apply them within 24 to 48 hours;\n2. keep an eye on the list of administrators and on the `uploads` folder, which give away most post-exploitation compromises.\n\n*An overview in English (9 min) of the WooCommerce Payments flaw and the steps to secure a store.*\n\n*Video in French (7 min): a roundup of security best practices for a WooCommerce store.*\n\n## What WP Masquerade changes (and what it does not)\n\nTo be clear: no camouflage plugin fixes a flaw like CVE-2023-28121. Only updating protected you. However, the July 2023 campaign highlights a stage where WP Masquerade does play a role: reconnaissance. The attackers first looked for the plugin's `readme.txt` to find targets.\n\n- WP Masquerade makes [the files of its own plugins invisible to scanners](https://www.wp-masquerade.com/features/file-url-aliases/) on [Apache](https://www.wp-masquerade.com/glossary/apache-http-server/) and [LiteSpeed](https://www.wp-masquerade.com/glossary/litespeed/); this file-hiding approach reduces the information a scanner can gather about a site, without replacing updates of third-party plugins;\n- the [bot traps](https://www.wp-masquerade.com/features/bot-traps/) count requests to sensitive URLs or to files that attack bots look for, an early signal when a scanning campaign starts; Pro adds a log and automatic banning;\n- [email alerts](https://www.wp-masquerade.com/features/email-alerts/) (Pro) warn you of abnormal activity; [vulnerable plugin alerts](https://www.wp-masquerade.com/features/vulnerable-plugin-alerts/) (Pro) flag every known flaw in an installed plugin or theme, explain what it allows and give the patched version.\n\n### Key takeaways\n\n- CVE-2023-28121 let anyone impersonate a store administrator through the X-Wcpay-Platform-Checkout-User header.\n- Affected versions: WooCommerce Payments 4.8.0 to 5.6.1; fixed as of the 5.6.2 branch.\n- The July 2023 campaign peaked at 1.3 million attacks in one day, after a reconnaissance phase using readme.txt.\n- Check the version, unknown administrators, the WP Console plugin and the uploads folder.\n- If in doubt, regenerate passwords, API keys and the wp-config.php salts.\n\n## Sources\n\n- [NVD: CVE-2023-28121](https://nvd.nist.gov/vuln/detail/CVE-2023-28121)\n- [WooCommerce: Critical Vulnerability Detected in WooCommerce Payments, What You Need to Know](https://developer.woocommerce.com/2023/03/23/critical-vulnerability-detected-in-woocommerce-payments-what-you-need-to-know/)\n\nOther sources consulted: security research publications, trade press articles and Wordfence database.\n\n## WordPress security, without the noise\n\nOne e-mail when something matters: new attacks seen in the wild, plugin updates and practical guides. No spam, unsubscribe in one click.",
    "categories": [
        "WooCommerce and e-commerce"
    ],
    "format": "application/json"
}