WordPress Sadad QA Payment plugin <= 1.28 - Unauthenticated Arbitrary Order Payment Confirmation vulnerability

Unauthenticated Arbitrary Order Payment Confirmation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Sadad QA Payment versions = 1.29...

WordPress PayPlug for WooCommerce (Official) plugin 2.8.0-3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure vulnerability

Unauthenticated Arbitrary Order Deletion, Modification and Disclosure vulnerability discovered by Sakri Rafael Koskimies in WordPress Plugin PayPlug for WooCommerce Official versions 2.8.0-3.1.0...

CVE-2026-113813

The PayPlug for WooCommerce (Official) WordPress plugin (versions 2.8.0-3.1.0 ) contains a vulnerability where it fails to perform capability or ownership checks on specific unauthenticated AJAX actions . An unauthenticated attacker can exploit this by providing a caller-supplied order identifier...

CVE-2026-113813 PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure

The PayPlug for WooCommerce Official WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently...

CVE-2026-113813 PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure

The PayPlug for WooCommerce Official WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently...

CVE-2026-103312

The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment notifications on a stock install, because the callback's checksum is keyed on a merchant secret that is empty until it is manually configured, allowing an unauthenticated attacker to...

PT-2026-123175

Name of the Vulnerable Software and Affected Versions OPay Payment Gateway for WooCommerce WordPress plugin versions prior to 2.5.6 Description The plugin fails to properly verify that payment notifications originate from the payment provider because the secret used to validate signatures is empt...

WordPress Moloni plugin < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation vulnerability

Subscriber+ Arbitrary Order Invoice Generation vulnerability discovered by Seongwon LEE in WordPress Plugin Moloni versions 5.0.14...

CVE-2026-106932 Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoice

The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fisca...

CVE-2026-106932 Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoice

The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fisca...

CVE-2026-106932

The Moloni WordPress plugin versions prior to 5.0.14 is vulnerable to an authorization bypass. The plugin fails to perform capability or nonce checks on several authenticated AJAX actions, relying instead on the presence of a stored connection to an external invoicing provider. This allows any au...

CVE-2026-94272 Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

WordPress Snap Finance plugin 1.0.8-3.11.0 - Unauthenticated Arbitrary Order Status Change vulnerability

Unauthenticated Arbitrary Order Status Change vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Snap Finance versions 1.0.8-3.11.0...

CVE-2026-94272

The Snap Finance WordPress plugin versions before 3.12.0 is vulnerable to an authentication bypass. The plugin fails to verify that requests to change a WooCommerce order's status originate from an authorized source. This allows unauthenticated attackers to manipulate order states, such as moving...

CVE-2026-94272 Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

WordPress Cardinity Payment Gateway for WooCommerce plugin 3.2.6-3.4.1 - Unauthenticated Arbitrary Order Payment Forgery vulnerability

Unauthenticated Arbitrary Order Payment Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Cardinity Payment Gateway for WooCommerce versions 3.2.6-3.4.1...

CVE-2026-103324

The Cardinity Payment Gateway for WooCommerce WordPress plugin versions prior to 3.4.2 is vulnerable to unauthenticated payment notification forgery. The root cause is that the plugin does not properly verify the authenticity of received notifications because the signing secret is empty by defaul...

CVE-2026-91076

The Robokassa payment for WooCommerce WordPress plugin (versions before 1.9.0 ) is vulnerable to an unauthenticated status change due to a lack of authenticity verification on incoming payment-notification requests. An attacker can exploit this to force any WooCommerce order into a failed state ....

WordPress elegro Crypto Payment plugin <= 1.0.1 - Unauthenticated Arbitrary Order Status Change vulnerability

Unauthenticated Arbitrary Order Status Change vulnerability discovered by JunHee CHO in WordPress Plugin elegro Crypto Payment versions = 1.0.1...

CVE-2026-94299 elegro Crypto Payment <= 1.0.1 - Unauthenticated Arbitrary Order Status Change via IPN Callback

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where...