CVE-2026-82215

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...

CVE-2026-82215

The Payment Gateway PayPay for WooCommerce WordPress plugin (versions 0.5 through 0.9.3) fails to verify the authenticity of incoming payment notification webhooks before acting on them. An unauthenticated attacker who knows a store's merchant identifier can mark arbitrary orders as paid , or can...

CVE-2026-82215 WC PayPay Gateway 0.5 - 0.9.3 - Unauthenticated Payment Bypass via Unverified Webhook

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...

EUVD-2026-76038

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...

Malicious code in paypay-sample-ecommerce-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 09b31b1430f2e801aefc6f5a16cfbd3d5311746728695bc5d3ae462fbba5049d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in paypay-ecommerce-miniapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1b7ace2d557b78c19ca9d9f0d89799a93ced84a6b8f9715dfcc460999be4178 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5249 Malicious code in paypay-sample-ecommerce-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 09b31b1430f2e801aefc6f5a16cfbd3d5311746728695bc5d3ae462fbba5049d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...