EUVD-2026-64218

The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount, allowing unauthenticated attackers to mark arbitrary orders as paid without...

CVE-2026-15150

The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a...

EUVD-2026-63909

The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a...

CVE-2026-73398

Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions...

CVE-2026-32468

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...

EUVD-2026-60817

Unauthenticated Insecure Direct Object References IDOR in Razorpay for WooCommerce = 4.8.7 versions...

CVE-2026-73398

Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions...

EUVD-2026-60805

Unauthenticated Broken Authentication in Flutterwave WooCommerce = 3.3.0 versions...

CVE-2026-73399

Unauthenticated Broken Authentication in Flutterwave WooCommerce = 3.3.0 versions...

CVE-2026-73398 WordPress Piraeus Bank WooCommerce Payment Gateway plugin 3.2.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions...

CVE-2026-73398

The WordPress Piraeus Bank WooCommerce Payment Gateway plugin 3.2.0 has a broken authentication flaw exploitable by unauthenticated remote attackers, allowing unauthorized actions with low integrity and availability impact. CVSS 6.5 (Medium). Patchstack advisory linked; no exploit code or specifi...

EUVD-2026-60804

Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions...

CVE-2026-32468

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...

EUVD-2026-60904

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...

CVE-2026-32468

CVE-2026-32468 is an unauthenticated sensitive data exposure vulnerability in the Duitku Payment Gateway WordPress plugin, affecting versions 2.11.14 and below . The flaw allows remote attackers to access sensitive data without any prior authentication, as reflected by the CVSS 3.1 score of 7.5 (...

CVE-2026-32468 WordPress Duitku Payment Gateway plugin <= 2.11.14 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...

PT-2026-77046

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...

PT-2026-77119

Unauthenticated Broken Authentication in Flutterwave WooCommerce = 3.3.0 versions...

PT-2026-77118

Name of the Vulnerable Software and Affected Versions Piraeus Bank WooCommerce Payment Gateway version 3.2.0 Description The software contains a broken authentication mechanism that allows unauthenticated access. Recommendations At the moment, there is no information about a newer version that...

WordPress Payment Gateway for PayPal on WooCommerce plugin < 9.2.1 - Unauthenticated Payment Bypass via PayPal Advanced Return Handler vulnerability

Unauthenticated Payment Bypass via PayPal Advanced Return Handler vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Payment Gateway for PayPal on WooCommerce versions 9.2.1...