CVE-2025-46018-CSC-Pay-Mobile-App-Payment-Authentication-Bypass

CVE-2025-46018 – CSC Pay 모바일 앱 결제 인증 우회 요약 CSC Pay 모바일 앱에서 결제 인증 우회 취약점 이 발견되었으며, 2.19.4 버전에 영향을 미칩니다. 이 결함으로 인해 공격자는 결제를 시작하고, 프로세스의 특정 시점에서 Bluetooth를 비활성화한 뒤 요금이 청구되지 않은 채 세탁기를 작동시킬 수 있었습니다. 이 문제는 책임 있는 공개 절차를 거쳐 공개되었으며, 현재 CVE-2025-46018 로 추적되고 있습니다. 영향을 받는 제품 제품 : CSC Pay 모바일 앱 버전 : 2.19.4...

WordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Pay with Vipps for WooCommerce versions = 6.2.0...

CVE-2026-5718-PR-V-EXPLO-T

CVE-2026-5718-PR-V-EXPLO-T WORDPRESS https://satoshidisk.com/pay/CRatNk...

CVE-2026-97259

Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4...

CVE-2026-97259 WordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4...

CVE-2026-97259

The Pay with Vipps for WooCommerce plugin (versions up to and including 6.2.4 ) is vulnerable to an Insecure Direct Object References (IDOR) flaw. This Authorization Bypass occurs because of incorrectly configured access control security levels, allowing attackers to exploit a User-Controlled Key...

EUVD-2026-89960

Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4...

CVE-2026-97259: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4...

CVE-2026-89426

The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the maybeupdateuserrole function reading the target role directly from an attacker-controlled Gravity Forms entry...

EUVD-2026-86579

The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the maybeupdateuserrole function reading the target role directly from an attacker-controlled Gravity Forms entry...

CVE-2026-89426

The Knit Pay WordPress plugin (versions up to and including 9.6.1.0 ) is vulnerable to Privilege Escalation . The root cause is the maybe_update_user_role() function, which reads a target role directly from an attacker-controlled Gravity Forms entry field (via user_role_field_id) and passes it to...

CVE-2026-89426 Knit Pay <= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Field

The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the maybeupdateuserrole function reading the target role directly from an attacker-controlled Gravity Forms entry...

CVE-2026-89426 Knit Pay <= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Field

The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the maybeupdateuserrole function reading the target role directly from an attacker-controlled Gravity Forms entry...

CVE-2026-89426: Improper Privilege Management

The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the maybeupdateuserrole function reading the target role directly from an attacker-controlled Gravity Forms entry...

WordPress Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin <= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by moonge in WordPress Plugin Knit Pay versions = 9.6.1.0...

CVE-2026-12739

The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-12739 WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-12739

The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 4.5.0 . The root cause is that the plugin does not properly verify user authorization before performing actions. An authenticated attacker ...

EUVD-2026-82760

The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-12739 WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...