EUVD-2026-109622

The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the...

BlueSnap Payment Gateway for WooCommerce <=3.4.0 - IPN Authorization Bypass

BlueSnap Payment Gateway for WooCommerce = 3.4.0 validates its unauthenticated IPN webhook using WooCommerce's client-IP geolocation, which trusts spoofed forwarding headers instead of requiring a webhook signature. Version 3.4.1 replaces the IP check with HMAC-SHA256 security headers. This...

CVE-2026-104641

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an...

CVE-2026-87837

The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as...

CVE-2026-111957

The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being completed, nor check the payment amount against the order total, allowing unauthenticated users to mark a pending order as paid by replaying a payment...

CVE-2026-87837

The Wava Payment Plugin for WordPress (versions before 0.3.10 ) is vulnerable to an unauthenticated order status change due to a failure to verify the authenticity of incoming payment-provider notifications. An unauthenticated attacker can manipulate any WooCommerce order status, such as marking ...

EUVD-2026-107086

The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as...

CVE-2026-87837 Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment Webhook

The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as...

CVE-2026-87837 Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment Webhook

The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as...

WordPress Wava Payment Plugin plugin 0.3.1-0.3.9 - Unauthenticated Order Status Change vulnerability

Unauthenticated Order Status Change vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Wava Payment versions 0.3.1-0.3.9...

EUVD-2026-107079

The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being completed, nor check the payment amount against the order total, allowing unauthenticated users to mark a pending order as paid by replaying a payment...

PT-2026-120500

The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an...

PT-2026-120482

The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as...

PT-2026-120474

The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being completed, nor check the payment amount against the order total, allowing unauthenticated users to mark a pending order as paid by replaying a payment...

CVE-2026-94272

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

CVE-2026-94272

The Snap Finance WordPress plugin versions before 3.12.0 is vulnerable to an authentication bypass. The plugin fails to verify that requests to change a WooCommerce order's status originate from an authorized source. This allows unauthenticated attackers to manipulate order states, such as moving...

CVE-2026-94272 Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

EUVD-2026-104106

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

EUVD-2026-104100

The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually completed before recording an order as paid, allowing unauthenticated users to mark any unpaid order as paid and to rewrite its total...

CVE-2026-94273

The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment...