5951 matches found
CVE-2026-67363
The stripeCharges and payAuthorize endpoints in Balbooa Forms (versions before 2.4.3.2) accept the charge total from a client-controlled parameter without recomputing it from configured prices and lack authentication or CSRF checks. An unauthenticated attacker can purchase priced items for arbitr...
CVE-2026-18779 TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Appointment and Payment Record Deletion via update_appointment_booked
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records...
CVE-2026-18779
The TrueBooker WordPress plugin (versions before 1.2.7 ) has a missing authorisation check in the update_appointment_booked AJAX action, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records. The vulnerability was disc...
CVE-2026-18031 TabaPay Gateway <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback
The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator...
CVE-2026-18031
The TabaPay Gateway WordPress plugin (through 1.4.0 ) contains an unauthenticated account takeover vulnerability. The plugin does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing any unauthenticated attacker to log in a...
PT-2026-78352
Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.3.2 Description An issue exists where the 'stripeCharges' and 'payAuthorize' endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without...
Malicious code in agora402-payment-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c7a0b2d80c3876cf42a18bbe6b9f74b728270a70953007cdcfb46ee89453a3f The package advertises itself as a payment utility library, but its public API validateRecipient, routePayment, processPayment discards the...
CVE-2026-73398
Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions...
CVE-2026-32468
Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...
CVE-2026-74009
The WordPress Razorpay for WooCommerce plugin (versions ≤ 4.8.7) has an unauthenticated IDOR vulnerability allowing unauthorized access to arbitrary object references. CVSS 5.3 (MEDIUM) reflects low integrity impact. Exploitation details are not provided. Upgrade to a patched version beyond 4.8.7...
EUVD-2026-60817
Unauthenticated Insecure Direct Object References IDOR in Razorpay for WooCommerce = 4.8.7 versions...
EUVD-2026-60805
Unauthenticated Broken Authentication in Flutterwave WooCommerce = 3.3.0 versions...
CVE-2026-73398
Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions...
CVE-2026-73399
The rave-woocommerce-payment-gateway plugin (versions ≤ 3.3.0) has an unauthenticated broken authentication flaw allowing remote attackers to bypass login, rated CVSS 6.5 (Medium). No exploitation evidence is provided; update to a newer plugin version when available. Reference: https://patchstack...
CVE-2026-73399
Unauthenticated Broken Authentication in Flutterwave WooCommerce = 3.3.0 versions...
EUVD-2026-60804
Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions...
CVE-2026-73399 WordPress Flutterwave WooCommerce plugin <= 3.3.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Flutterwave WooCommerce = 3.3.0 versions...
CVE-2026-73398 WordPress Piraeus Bank WooCommerce Payment Gateway plugin 3.2.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions...
CVE-2026-73398
The WordPress Piraeus Bank WooCommerce Payment Gateway plugin 3.2.0 has a broken authentication flaw exploitable by unauthenticated remote attackers, allowing unauthorized actions with low integrity and availability impact. CVSS 6.5 (Medium). Patchstack advisory linked; no exploit code or specifi...