CVE-2026-87837 Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment Webhook

The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as...

CVE-2026-87837

The Wava Payment Plugin for WordPress (versions before 0.3.10 ) is vulnerable to an unauthenticated order status change due to a failure to verify the authenticity of incoming payment-provider notifications. An unauthenticated attacker can manipulate any WooCommerce order status, such as marking ...

WordPress Wava Payment Plugin plugin 0.3.1-0.3.9 - Unauthenticated Order Status Change vulnerability

Unauthenticated Order Status Change vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Wava Payment versions 0.3.1-0.3.9...

PT-2026-120482

The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as...

CVE-2026-94272

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

CVE-2026-94272 Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

EUVD-2026-104106

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

CVE-2026-94272

The Snap Finance WordPress plugin versions before 3.12.0 is vulnerable to an authentication bypass. The plugin fails to verify that requests to change a WooCommerce order's status originate from an authorized source. This allows unauthenticated attackers to manipulate order states, such as moving...

CVE-2026-97851

The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TODELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record...

CVE-2026-97851

The J4Care dcm4che software contains a Missing Authorization vulnerability (CWE-862) within its storage status-change REST service . An attacker can modify location records associated with DICOM instances to a TO_DELETE state. This action triggers the PurgeStorageScheduler to delete the reference...

CVE-2026-97851 J4Care dcm4che Missing Authorization

The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TODELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record...

EUVD-2026-102890

The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TODELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record...

PT-2026-115626

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The storage status-change REST service allows location records associated with DICOM instances to be transitioned to deletion-related states. Specifically,...

EUVD-2026-101862

The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including marking unpaid orders as paid and...

CVE-2026-91076 Robokassa payment for WooCommerce < 1.9.0 - Unauthenticated Arbitrary Order Status Change to Failed

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it, allowing unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers...

CVE-2026-91076

The Robokassa payment for WooCommerce WordPress plugin (versions before 1.9.0 ) is vulnerable to an unauthenticated status change due to a lack of authenticity verification on incoming payment-notification requests. An attacker can exploit this to force any WooCommerce order into a failed state ....

WordPress Robokassa payment gateway for Woocommerce plugin < 1.9.0 - Unauthenticated Arbitrary Order Status Change to Failed vulnerability

Unauthenticated Arbitrary Order Status Change to Failed vulnerability discovered by JunHee CHO in WordPress Plugin Robokassa payment gateway for Woocommerce versions 1.9.0...

CVE-2026-86851

The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and...

CVE-2026-86851 Livees Checkout 6.8 - 7.0.2 - Unauthenticated Order Status Change, Order Note Injection & Order Key Disclosure

The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and...

CVE-2026-86851

The Livees Checkout WordPress plugin, affecting versions up to 7.0.2 , contains a vulnerability where it fails to perform necessary capability, nonce, or order-key checks on the order confirmation page. This flaw allows unauthenticated users to manipulate request parameters to change the status o...