CVE-2026-89420

Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged. MPP.Session.Actions.acceptvoucher/3 in lib/mpp/session/actions.ex treats a voucher whose cumulativeAmount equals the channel's...

CVE-2026-92400 Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via Sandbox IPN Environment Confusion

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated user...

CVE-2026-92400

The Payment Gateway for PayPal on WooCommerce WordPress plugin (before version 9.2.1 ) fails to verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order as complete. This allows una...

WordPress Paid Membership Subscriptions plugin < 3.0.9 - Unauthenticated Membership Payment Bypass vulnerability

Unauthenticated Membership Payment Bypass vulnerability discovered by Charles Vosburgh in WordPress Plugin Paid Member Subscriptions versions 3.0.9...

WordPress Robokassa payment gateway for Woocommerce plugin < 1.8.9 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin Robokassa payment gateway for Woocommerce versions 1.8.9...

CVE-2026-54608

MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicaldashstripepayments before Stripe checkout succeeds and embeds the payment code in the success redirect, while GET...

CVE-2026-54608 MythicalDash: Unauthenticated payment bypass in Stripe success-redirect endpoint allows arbitrary free credit top-up

MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicaldashstripepayments before Stripe checkout succeeds and embeds the payment code in the success redirect, while GET...

CVE-2026-54608 MythicalDash: Unauthenticated payment bypass in Stripe success-redirect endpoint allows arbitrary free credit top-up

MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicaldashstripepayments before Stripe checkout succeeds and embeds the payment code in the success redirect, while GET...

CVE-2026-16582 Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating...

CVE-2026-16582

The Booking for Appointments and Events Calendar – Amelia WordPress plugin is vulnerable to unauthenticated payment bypass in versions up to and including 2.4.5 . The root cause is that the plugin accepts a client-supplied package-redemption identifier as proof of payment without properly validat...

WordPress Booking for Appointments and Events Calendar – Amelia plugin <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass vulnerability

Missing Authorization to Unauthenticated Payment Bypass vulnerability discovered by ricky morty in WordPress Plugin Amelia versions = 2.4.5...

CVE-2026-91017 Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT Callback

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders...

CVE-2026-91017 Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT Callback

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders...

CVE-2026-90922 Paid Member Subscriptions < 3.0.9 - Unauthenticated Membership Payment Bypass via PayPal Standard Amount and Currency Mismatch

The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated users to obtain a paid membership by paying an arbitrary lower amount...

CVE-2026-90922

The Paid Membership Subscriptions WordPress plugin before 3.0.9 fails to verify that the amount and currency reported by the payment provider match the pending payment before completing it. The CVELIST and VULNRICHMENT records identify PayPal Standard as the specific payment provider involved. Th...

WordPress Eventin plugin < 4.1.24 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by cyberkareem in WordPress Plugin WP Event Solution versions 4.1.24...

CVE-2026-84906 Eventin < 4.1.24 - Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transaction Replay

The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway reports the transaction as successful, not its amount, currency, or which order it belongs to, allowing unauthenticated visitors ...

CVE-2026-84906

Eventin WordPress plugin versions before 4.1.24 contain an unauthenticated payment bypass affecting its Stripe and PayPal integrations. The plugin fails to verify that a completed payment corresponds to the specific order it is applied to, checking only that the gateway reports the transaction as...

CVE-2026-77702 Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token

The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge...

WordPress Booking for Appointments and Events Calendar plugin 9.0-9.8.0 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin Amelia versions 9.0-9.8.0...