72 matches found
CVE-2026-106027 Oxygen MyData for WooCommerce 3.0.0 - 3.0.8 - Unauthenticated Arbitrary Order Completion via EveryPay Status Callback
The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed...
WordPress Oxygen MyData for WooCommerce plugin 3.0.0-3.0.8 - Unauthenticated Arbitrary Order Completion vulnerability
Unauthenticated Arbitrary Order Completion vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Oxygen MyData for WooCommerce versions 3.0.0-3.0.8...
CVE-2026-106027
The Oxygen MyData for WooCommerce WordPress plugin (versions before 3.0.9 ) is vulnerable to unauthorized actions due to a lack of proper authorization and request authenticity validation on one of its payment callbacks (specifically the EveryPay Status Callback ). This flaw allows unauthenticate...
CVE-2026-106027: Unknown Oxygen MyData for WooCommerce: The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the…
The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed...
CVE-2026-121993
wePOS Point Of Sale for WooCommerce before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the...
CVE-2026-121993
The wePOS (Point Of Sale for WooCommerce) plugin versions before 2.0.3 is susceptible to a missing authorization vulnerability in the wepos/v1/payment/process REST route. This flaw allows authenticated vendor-level users, such as Dokan vendor staff with the publish_shop_orders capability, to mani...
CVE-2026-121993 wePOS before 2.0.3 Missing Authorization via payment/process Endpoint
wePOS Point Of Sale for WooCommerce before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the...
CVE-2026-121993 wePOS before 2.0.3 Missing Authorization via payment/process Endpoint
wePOS Point Of Sale for WooCommerce before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the...
EUVD-2026-116911
wePOS Point Of Sale for WooCommerce before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the...
PT-2026-136969
wePOS Point Of Sale for WooCommerce before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the publish...
CVE-2026-121993: wedevs wePOS – Point Of Sale (POS) for WooCommerce & Dokan: wePOS (Point Of Sale for WooCommerce) before 2.0.3 contains a missing authorization vulnerability in the…
wePOS Point Of Sale for WooCommerce before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the...
CVE-2026-92400
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated user...
CVE-2026-92400: Insufficient Verification of Data Authenticity
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated user...
CVE-2026-86809
The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained...
CVE-2026-86809
The Persian Elementor WordPress plugin, versions 2.7.10 through before 2.8.2 , fails to verify that the payment authority returned in its ZarinPal payment callback belongs to the specific transaction being completed. This allows unauthenticated attackers to complete a pending order by replaying a...
EUVD-2026-76040
The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained...
CVE-2026-86809: Insufficient Verification of Data Authenticity
The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained...
PT-2026-89839
The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained...
