CVE-2026-102776

The Joomla Extension - svenbluege.de 's Event Gallery extension (versions

CVE-2026-97219

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying...

CVE-2026-97219

The MStore API WordPress plugin before version 4.22.1 is vulnerable to a payment bypass due to a lack of restriction on which fields of an order a customer can update. This allows any authenticated user with a self-registerable account to modify the status of their own unpaid orders to a paid or ...

EUVD-2026-91216

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying...

CVE-2026-81740

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of...

CVE-2026-81740

The Paytm Payment Gateway WordPress plugin in versions before 2.8.9 is vulnerable to unauthenticated order status manipulation. The root cause is a failure to verify that payment callbacks genuinely originate from the payment provider when the secret key has not been configured, which is the defa...

CVE-2026-81740 Paytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment Callback

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of...

EUVD-2026-91201

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of...

WordPress Paytm Payment Gateway plugin < 2.8.9 - Unauthenticated Order Status Manipulation vulnerability

Unauthenticated Order Status Manipulation vulnerability discovered by Artus KG in WordPress Plugin Paytm Payment Gateway versions 2.8.9...

PT-2026-104115

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying...

CVE-2026-93580 InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment Webhook

The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipme...

CVE-2026-93580

The InPost PL WordPress plugin (versions prior to 1.9.8 ) is vulnerable to unauthenticated order status forgery. The root cause is a failure to verify the authenticity of incoming shipment webhook requests; the plugin relies on a non-secret identifier and an unenforced IP check. This allows an un...

WordPress InPost PL plugin 1.7.5-1.9.7 - Unauthenticated Order Status Forgery vulnerability

Unauthenticated Order Status Forgery vulnerability discovered by ryan fabella in WordPress Plugin InPost PL versions 1.7.5-1.9.7...

CVE-2026-93580 InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment Webhook

The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipme...

PT-2026-99779

Name of the Vulnerable Software and Affected Versions Verge3D WordPress plugin versions 4.1.0 through 4.13.0 Description An issue exists where the plugin fails to verify payment status with the payment provider and does not validate order ownership. This allows unauthenticated users to mark any...

CVE-2026-84091

The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment...

CVE-2026-84091

The SUMIT Payment Gateway for WooCommerce WordPress plugin (versions before 4.0.0 ) is vulnerable to an Unauthenticated Payment Confirmation Forgery . The root cause is a failure to verify payment notifications with the payment provider before marking orders as paid. This allows unauthenticated u...

CVE-2026-84091 SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via bit IPN

The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment...

PT-2026-97303

Name of the Vulnerable Software and Affected Versions SUMIT Payment Gateway for WooCommerce WordPress plugin versions prior to 4.0.0 Description The plugin fails to verify the authenticity of payment notifications with the payment provider before marking an order as paid. This allows...

PT-2026-96060

Name of the Vulnerable Software and Affected Versions Payment Gateway for PayPal on WooCommerce WordPress plugin versions prior to 9.2.1 Description An issue exists where the plugin fails to verify if an incoming payment notification was confirmed within the store's configured payment environment...