CVE-2026-91075

The Eupago Gateway For Woocommerce WordPress plugin, versions 4.5.0 through 4.7.5 , is vulnerable to an unauthenticated payment confirmation bypass . In certain configurations, the plugin fails to verify the authenticity of incoming payment-confirmation webhook requests. This allows an unauthenti...

EUVD-2026-115719

The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark a pending order as paid without payin...

EUVD-2026-110607

The Payex Payment Gateway for Woocommerce WordPress plugin through 1.2.10 does not properly verify the authenticity of incoming payment notifications, relying on a validation secret that is empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark any ord...

CVE-2026-103302

The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark...

EUVD-2026-107050

The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark...

PT-2026-120445

The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark...

CVE-2026-92427

The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge...

EUVD-2026-102685

The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge...

PT-2026-68640

Name of the Vulnerable Software and Affected Versions Payment Gateway for Redsys & WooCommerce Lite WordPress plugin versions prior to 7.0.2 Description The plugin fails to verify the authenticity of incoming payment-provider notifications for a specific payment method before marking orders as...