CVE-2026-14842

The CVE-2026-14842 entry concerns the Events Made Easy WordPress plugin prior to version 3.1.2. The root cause is that the payment authorization token is not bound to the specific payment record being charged, enabling an unauthenticated attacker to pay a lower amount for a cheap booking while a ...

CVE-2026-14842 Events Made Easy < 3.1.2 - Unauthenticated Payment Bypass

The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid...

CVE-2026-13399

The CVE refers to the WordPress PayPal WooCommerce Payment Plugins prior to version 2.0.20, which contains an authorization check flaw on a REST endpoint that allows unauthenticated users to bypass payments. Affected component: Payment Plugins for PayPal WooCommerce (WordPress plugin). Root cause...

CVE-2026-13399 Payment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments...

CVE-2026-12584 Payment Gateway for Redsys & WooCommerce Lite < 7.0.2 - Unauthenticated Payment Confirmation via Unverified Inespay Callback

The Payment Gateway for Redsys & WooCommerce Lite WordPress plugin before 7.0.2 does not verify the authenticity of incoming payment-provider notifications for one of its payment methods before marking orders as paid, allowing unauthenticated attackers to forge a payment-confirmation callback and...

CVE-2026-12584

Technical details (affected versions, root cause, impact, fixes) are not publicly available in the provided documents. Monitor for updates.

CVE-2026-10599

The CVE concerns the Integrate PhonePe with WooCommerce WordPress plugin (versions up to 1.2.1). The root cause is that the plugin does not validate that a verified payment transaction belongs to the order being marked as paid, nor verify the authenticity of the payment-completion request. This a...

CVE-2026-15246

The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages...

EUVD-2026-53935

The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages...

CVE-2026-15246

Vulnerability summary (CVE-2026-15246). The RealHomes Memberships WordPress plugin prior to version 3.1.0 fails to verify that a membership payment completed, and does not check a nonce or user capability before granting a paid membership package. This allows any authenticated user (e.g., a Subsc...

CVE-2026-15246 RealHomes Memberships < 3.1.0 - Subscriber+ Membership Payment Bypass

The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages...

CVE-2026-16734

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a...

CVE-2026-16734 Stripe Payment Forms by WP Full Pay < 8.5.2 - Unauthenticated Payment Intent Amount Manipulation

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a...

CVE-2026-16734

The CVE concerns the Stripe Payment Forms by WP Full Pay WordPress plugin (before version 8.5.2). Two unauthenticated payment-form AJAX actions do not verify ownership of the referenced Stripe payment intent, enabling an unauthenticated visitor (with a page-embedded nonce) to alter the payment am...

EUVD-2026-53725

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a...

EUVD-2026-53719

The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token, allowing unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment...

CVE-2026-55739

Crater isolates data per companyid, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and -hasCompany-companyid. CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound custome...

EUVD-2026-42658

Ghost: Paid gift memberships obtainable at minimal cost via the donations feature...

GHSA-2364-JH4Q-M9VM Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint

Summary An Insecure Direct Object Reference IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint. This flaw allows an authenticated attacker to bypass authorization checks and retrieve sensitive payment and profile information of other customers by manipulati...

EUVD-2026-52176

The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes...