CVE-2026-103382

The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation, allowing unauthenticated attackers to forge a notification and mark any pending WooCommerce order as paid,...

CVE-2026-103331

The UniPAY Payment Gateway For WooCommerce WordPress plugin through 2.3 does not properly verify the authenticity of payment notifications, as their signature is checked against a merchant secret that is empty by default, allowing unauthenticated attackers to forge a valid notification and mark...

CVE-2026-103325

The TiendaCrypto para WooCommerce WordPress plugin (versions through 1.2.1 ) contains a vulnerability where it fails to correctly verify the authenticity of its payment webhooks. The root cause is that the plugin validates the request signature against a key that is consistently empty . This flaw...

CVE-2026-103359 PayDunya WooCommerce Payment Gateway 1.1.6 - Unauthenticated Order Payment Completion via Webhook Forgery

The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming payment notifications and, until the gateway is configured, authenticates them with a value derived from an empty secret that anyone can compute, allowing unauthenticated attackers...

CVE-2026-103325 TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery via Webhook HMAC Bypass

The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary...

CVE-2026-103359

The PayDunya WooCommerce Payment Gateway WordPress plugin, version 1.1.6 and below , contains a vulnerability where it fails to verify the authenticity of incoming payment notifications. Until the gateway is configured, the plugin authenticates these notifications using a value derived from an em...

WordPress Mintpay for WooCommerce plugin <= 2.2.3 - Unauthenticated Order Payment Completion and Cancellation vulnerability

Unauthenticated Order Payment Completion and Cancellation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Mintpay for WooCommerce versions = 2.2.3...

WordPress Eurobank WooCommerce Payment Gateway plugin <= 2.1.1 - Unauthenticated Order Payment Forgery vulnerability

Unauthenticated Order Payment Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Eurobank WooCommerce Payment Gateway versions = 2.1.1...

WordPress CCAvenue Payment Gateway for WooCommerce plugin <= 3.1 - Unauthenticated Order Payment Completion vulnerability

Unauthenticated Order Payment Completion vulnerability discovered by Naoki Kawahigashi in WordPress Plugin CCAvenue Payment Gateway for WooCommerce versions = 3.1...

CVE-2026-103300 Eurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery via Unverified Callback

The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending...

CVE-2026-103300

The Eurobank WooCommerce Payment Gateway WordPress plugin (versions up to and including 2.1.1 ) is vulnerable to an unauthenticated order payment forgery . The root cause is the failure to verify that payment-confirmation requests originate from the legitimate payment provider, compounded by a de...

CVE-2026-103298

The CCAvenue Payment Gateway for WooCommerce WordPress plugin (versions through 3.1 ) is vulnerable to an unauthenticated order payment completion vulnerability via webhook forgery . The flaw exists because the plugin fails to verify if payment-confirmation requests genuinely originate from the p...

CVE-2026-103298 CCAvenue Payment Gateway for WooCommerce <= 3.1 - Unauthenticated Order Payment Completion via Webhook Forgery

The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install, allowing unauthenticated attackers to for...

WordPress Online Payments with iK Pay Gateway plugin < 3.0.4 - Unauthenticated Order Payment Forgery vulnerability

Unauthenticated Order Payment Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Online Payments with iK Pay Gateway versions 3.0.4...

CVE-2026-106014 Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback Forgery

The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hosted-payment return handler, allowing unauthenticated attackers to mark orders as paid without actually paying...

CVE-2026-106014

The Gateway for Vantiv on WC WordPress plugin, affecting versions through 1.0.1 , contains a vulnerability where it fails to verify the authenticity of payment notifications received via its hosted-payment return handler . This lack of validation allows unauthenticated attackers to perform a paym...

WordPress Cardinity Payment Gateway for WooCommerce plugin 3.2.6-3.4.1 - Unauthenticated Arbitrary Order Payment Forgery vulnerability

Unauthenticated Arbitrary Order Payment Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Cardinity Payment Gateway for WooCommerce versions 3.2.6-3.4.1...

CVE-2026-103324 Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Project Secret

The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mar...

CVE-2026-103324 Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Project Secret

The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mar...

CVE-2026-103324

The Cardinity Payment Gateway for WooCommerce WordPress plugin versions prior to 3.4.2 is vulnerable to unauthenticated payment notification forgery. The root cause is that the plugin does not properly verify the authenticity of received notifications because the signing secret is empty by defaul...