CVE-2026-15147

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark...

CVE-2026-15152

The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without a...

CVE-2026-12584

The Payment Gateway for Redsys & WooCommerce Lite WordPress plugin before 7.0.2 does not verify the authenticity of incoming payment-provider notifications for one of its payment methods before marking orders as paid, allowing unauthenticated attackers to forge a payment-confirmation callback and...

CVE-2026-13399

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments...

CVE-2026-12501

The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid, allowing unauthenticated attackers to mark bookin...

CVE-2026-10599

The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the order being marked as paid, nor does it verify the authenticity of its payment-completion request, allowing unauthenticated attackers to reuse a single valid...

CVE-2026-16067 Event Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via Client-Controlled Ticket Price

The Event Booking Manager for WooCommerce Pro WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native non-WooCommerce checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows...

CVE-2026-15208

The CVE pertains to the RegistrationMagic WordPress plugin prior to 6.0.9.5. The vulnerability arises because the server-side check only verifies that the PayPal capture status is COMPLETED, without validating the capture amount, currency, payee, or prior use against the target registration. This...

CVE-2026-15147 Five Star Restaurant Reservations < 2.7.23 - Unauthenticated Payment Bypass and Booking Confirmation via IDOR

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark...

CVE-2026-15147

The vulnerability CVE-2026-15147 affects the Five Star Restaurant Reservations WordPress plugin prior to version 2.7.23. The issue is an unauthenticated payment-notification bypass caused by failing to verify the payment recipient, amount, and status, and not binding the notification to the inten...

CVE-2026-14936

The CVE concerns the Simple Membership WordPress plugin prior to version 4.7.7, where PayPal IPN verification is not performed against the site’s configured merchant account before activating a membership. This allows unauthenticated users to activate or extend memberships using PayPal payments t...

CVE-2026-14936 Simple Membership < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification

The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayP...

CVE-2026-19127

CVE-2026-19127 affects the billing and license activation subsystem of the Postiz app. The issue arises from insufficient cryptographic validation or lack of server-side state verification for promotional/lifetime-deal (LTD) redemption codes, enabling an unauthenticated attacker to forge valid re...

CVE-2026-19127 Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions

An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting insufficient cryptographic validation or lack of server-side state verification on promotional/lifetime-deal LTD redemption codes, an unauthenticated attacker...

CVE-2026-19127 Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions

An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting insufficient cryptographic validation or lack of server-side state verification on promotional/lifetime-deal LTD redemption codes, an unauthenticated attacker...

CVE-2026-12501 WP Travel Engine < 6.8.2 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver and Amount Verification

The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid, allowing unauthenticated attackers to mark bookin...

CVE-2026-12501

CVE-2026-12501 affects the WP Travel Engine plugin for WordPress, prior to version 6.8.2. The vulnerability arises because the plugin does not verify that an incoming PayPal IPN is sent to the site’s merchant account, nor that the paid amount matches the order total, before marking a booking as p...

CVE-2026-12901 GetPaid < 2.8.55 - Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verification

The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made...

CVE-2026-15152

The vulnerability affects WP Hotel Booking plugin for WordPress prior to 2.3.2. It allows unauthenticated users to mark bookings as fully paid without actual payment: the plugin fails to verify that a PayPal payment notification corresponds to a payment to the site’s merchant account and that the...

CVE-2026-15152 WP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment Bypass

The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without a...