WordPress Thanh Toán Quét Mã QR Code Tự Động plugin <= 2.0.1 - Unauthenticated WooCommerce Order Payment Confirmation vulnerability

Unauthenticated WooCommerce Order Payment Confirmation vulnerability discovered by Pedro Pinho in WordPress Plugin Thanh Toán Quét Mã QR Code Tự Động versions = 2.0.1...

WordPress Sadad QA Payment plugin <= 1.28 - Unauthenticated Arbitrary Order Payment Confirmation vulnerability

Unauthenticated Arbitrary Order Payment Confirmation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Sadad QA Payment versions = 1.29...

WordPress Casso Flow plugin < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation vulnerability

Unauthenticated WooCommerce Order Payment Confirmation vulnerability discovered by Pedro Pinho in WordPress Plugin Casso Flow versions 4.2.0...

CVE-2026-103330 Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature Bypass

The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the verification is keyed on a merchant secret that is empty by default and the rest of the signed data is attacker-controlled, allowing unauthenticated attackers to...

CVE-2026-103382

The Casso Flow WordPress plugin, versions prior to 4.2.0 , contains a vulnerability where it fails to properly authenticate incoming bank-transfer payment notifications. On a default installation, the verification token is empty, which allows unauthenticated attackers to forge notifications and m...

CVE-2026-103382 Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation

The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation, allowing unauthenticated attackers to forge a notification and mark any pending WooCommerce order as paid,...