75 matches found
BlueSnap Payment Gateway for WooCommerce <=3.4.0 - IPN Authorization Bypass
BlueSnap Payment Gateway for WooCommerce = 3.4.0 validates its unauthenticated IPN webhook using WooCommerce's client-IP geolocation, which trusts spoofed forwarding headers instead of requiring a webhook signature. Version 3.4.1 replaces the IP check with HMAC-SHA256 security headers. This...
CVE-2026-84091
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment...
CVE-2026-84091 SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via bit IPN
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment...
CVE-2026-84091
The SUMIT Payment Gateway for WooCommerce WordPress plugin (versions before 4.0.0 ) is vulnerable to an Unauthenticated Payment Confirmation Forgery . The root cause is a failure to verify payment notifications with the payment provider before marking orders as paid. This allows unauthenticated u...
EUVD-2026-85265
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment...
CVE-2026-84091 SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via bit IPN
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment...
WordPress SUMIT Payment Gateway for WooCommerce plugin < 4.0.0 - Unauthenticated Payment Confirmation Forgery vulnerability
Unauthenticated Payment Confirmation Forgery vulnerability discovered by Pedro Pinho in WordPress Plugin SUMIT Payment Gateway for WooCommerce versions 4.0.0...
PT-2026-97303
Name of the Vulnerable Software and Affected Versions SUMIT Payment Gateway for WooCommerce WordPress plugin versions prior to 4.0.0 Description The plugin fails to verify the authenticity of payment notifications with the payment provider before marking an order as paid. This allows...
CVE-2026-84091: Improper Authentication
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment...
WordPress Payment Gateway of Stripe for WooCommerce plugin <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature vulnerability
Unauthenticated Improper Verification of Cryptographic Signature vulnerability discovered by pradeep suvarna in WordPress Plugin Stripe Payment Gateway for WooCommerce versions = 5.0.8...
WordPress Robokassa payment gateway for Woocommerce plugin < 1.8.9 - Unauthenticated Payment Bypass vulnerability
Unauthenticated Payment Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin Robokassa payment gateway for Woocommerce versions 1.8.9...
CVE-2026-91017 Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT Callback
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders...
CVE-2026-91017: Insufficient Verification of Data Authenticity
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders...
PT-2026-94187
Name of the Vulnerable Software and Affected Versions Robokassa payment gateway for Woocommerce WordPress plugin versions prior to 1.8.9 Description The plugin fails to verify the authenticity of incoming payment notifications when the non-default deferred-payment feature is enabled. This allows...
CVE-2026-78536: Missing Authorization
Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce = 1.8.9 versions...
CVE-2026-84043: Insufficient Verification of Data Authenticity
The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signature...
CVE-2026-73353 WordPress Revolut Gateway for WooCommerce plugin < 4.22.10 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce 4.22.10 versions...
PT-2026-71603
Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce 4.22.10 versions...