WordPress Integrate PhonePe with WooCommerce plugin <= 1.2.1 - Unauthenticated Payment Bypass via Transaction ID Reuse vulnerability

Unauthenticated Payment Bypass via Transaction ID Reuse vulnerability discovered by dangnosuy in WordPress Plugin Integrate PhonePe with WooCommerce versions = 1.2.1...

CVE-2026-10599: Insufficient Verification of Data Authenticity

The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the order being marked as paid, nor does it verify the authenticity of its payment-completion request, allowing unauthenticated attackers to reuse a single valid...