CVE-2026-94261 Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Payment Confirmation Forgery via an Unbound Transaction Id

The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transaction identifier from a payment of their own to mark arbitra...

WordPress Sifalo Pay plugin 2.0-2.5.2 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Ryan Fabella in WordPress Plugin Sifalo Pay versions 2.0-2.5.2...

CVE-2026-94261

The Sifalo Pay WordPress plugin (versions 2.0 through 2.5.2) contains a vulnerability where it fails to verify if a payment transaction identifier belongs to the specific order being confirmed or if the requester owns that order. This allows an unauthenticated attacker to use a valid transaction ...

CVE-2026-103329 Super Payments < 1.43.1 - Unauthenticated Payment Confirmation Forgery via Webhook Signature

The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary...

WordPress Super Payments plugin < 1.43.1 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Super Payments versions 1.43.1...

CVE-2026-103329

The Super Payments WordPress plugin (versions prior to 1.43.1 ) is vulnerable to an unauthenticated payment confirmation forgery . The flaw exists because the plugin fails to properly verify incoming payment webhook notifications, as the signing key used for signature validation is empty by defau...

WordPress Deema Payment Gateway plugin <= 1.1.2 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin Deema Payment Gateway versions = 1.1.2...

CVE-2026-94271 Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being...

CVE-2026-94271 Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being...

CVE-2026-94271

The Deema Payment Gateway WordPress plugin (versions

CVE-2026-96200 Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Payment Callback

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment...

WordPress Payments for Hubtel plugin < 1.0.2 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin Payments for Hubtel versions 1.0.2...

CVE-2026-96200 Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Payment Callback

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment...

WordPress SUMIT Payment Gateway for WooCommerce plugin < 4.0.0 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Pedro Pinho in WordPress Plugin SUMIT Payment Gateway for WooCommerce versions 4.0.0...

CVE-2026-84091 SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via bit IPN

The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment...

CVE-2026-84091 SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via bit IPN

The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment...

CVE-2026-16739

The Epeken All Kurir for Woocommerce WordPress plugin (versions through 2.1.4 ) contains an improper authentication vulnerability. The plugin fails to verify if a payment-confirmation request originates from the legitimate order owner or if a payment actually occurred. This allows unauthenticated...