EUVD-2026-115362

Munshi by Petpooja before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the...

CVE-2026-119731

Munshi by Petpooja before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the...

CVE-2026-119731

The Munshi (by Petpooja) platform (versions prior to 2026-06-30) is vulnerable to a payment bypass via its subscription payment webhook at POST /api/payment/order/webhook. The root cause is a lack of webhook authentication , cryptographic signature verification , source validation , and independe...

CVE-2026-119731 Munshi Payment Bypass via Unauthenticated Webhook Endpoint

Munshi by Petpooja before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the...

WordPress PayHere Payment Gateway plugin 2.4.0-2.4.5 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Naoki Kawahigashi in WordPress Plugin PayHere Payment Gateway Plugin for WooCommerce versions 2.4.0-2.4.5...

CVE-2026-103310 PayHere Payment Gateway 2.4.0 - 2.4.5 - Unauthenticated Payment Bypass via Unverified Payment Notification

The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without...

CVE-2026-103310

The PayHere Payment Gateway WordPress plugin, versions 2.4.0 through 2.4.5 , is vulnerable to an unauthenticated payment bypass . The root cause is a failure to verify the authenticity of payment notifications when the merchant secret is unset, which is the default configuration. This allows an u...

CVE-2026-119731: Petpooja Munshi: Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at…

Munshi by Petpooja before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the...

CVE-2026-119558 OpenCart through 4.1.0.4 Payment Bypass via Free Checkout Reward Points

OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handle...

CVE-2026-119558

OpenCart versions through 4.1.0.4 are affected by a business logic vulnerability (CWE-841) that allows logged-in customers to bypass payment requirements. By manipulating reward points during the checkout process, an attacker can select Free Checkout , apply points, and then submit zero points vi...

CVE-2026-118558

Cross-Site Request Forgery CSRF vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3...

WordPress BitPay Gateway for WooCommerce plugin <= 4.1.3 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin BitPay Gateway for WooCommerce versions = 4.1.3...

CVE-2026-103313

The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount, allowing an unauthenticated attacker who holds a single genuine low-value transaction to mark arbitrary...

CVE-2026-103313

The BitPay Gateway for WooCommerce WordPress plugin (versions

CVE-2026-103313 BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Return Handler

The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount, allowing an unauthenticated attacker who holds a single genuine low-value transaction to mark arbitrary...

PT-2026-130587

This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments via multiple Stripe APIs. When redirecting to Stripe Connect to generate an authorization code, the module does not incorporate a CSRF token into the return URI. This could allow...

WordPress LatePoint plugin < 5.7.5 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Filip Kowalski in WordPress Plugin LatePoint versions 5.7.5...

WordPress Simple Shopping Cart plugin < 5.3.3 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Simple Shopping Cart versions 5.3.3...

CVE-2026-105256

The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed...

CVE-2026-105256 LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' Parameter

The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed...