WordPress SUMIT Payment Gateway for WooCommerce plugin < 4.0.0 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Pedro Pinho in WordPress Plugin SUMIT Payment Gateway for WooCommerce versions 4.0.0...

CVE-2026-16739

The Epeken All Kurir for Woocommerce WordPress plugin affects versions through 2.1.4 . The vulnerability is caused by a lack of verification that a payment-confirmation request originates from the actual owner of the targeted order or that a payment occurred. This allows unauthenticated attackers...