CVE-2026-106027 Oxygen MyData for WooCommerce 3.0.0 - 3.0.8 - Unauthenticated Arbitrary Order Completion via EveryPay Status Callback

The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed...

WordPress Oxygen MyData for WooCommerce plugin 3.0.0-3.0.8 - Unauthenticated Arbitrary Order Completion vulnerability

Unauthenticated Arbitrary Order Completion vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Oxygen MyData for WooCommerce versions 3.0.0-3.0.8...

CVE-2026-106027

The Oxygen MyData for WooCommerce WordPress plugin (versions before 3.0.9 ) is vulnerable to unauthorized actions due to a lack of proper authorization and request authenticity validation on one of its payment callbacks (specifically the EveryPay Status Callback ). This flaw allows unauthenticate...

WordPress MStore API plugin < 4.21.1 - Subscriber+ Arbitrary Order Completion vulnerability

Subscriber+ Arbitrary Order Completion vulnerability discovered by Erwan LR WPScan in WordPress Plugin MStore API versions 4.21.1...