WordPress Walletdoc Payment Gateway for WooCommerce plugin < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery vulnerability

Unauthenticated SQLi and Order Payment Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Walletdoc Payment Gateway for WooCommerce versions 1.8.5...

CVE-2026-94360 Paymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card Callbacks

The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as paid, allowing unauthenticated attackers to mark orders as paid without any payment being completed...

CVE-2026-94360

The Paymentfor Gateway for WooCommerce WordPress plugin, in versions prior to 1.0.6 , is vulnerable to an unauthenticated order payment forgery . The root cause is a failure to verify the authenticity of inbound payment notifications before updating an order's status to paid. This allows unauthen...

WordPress Paymentfor Gateway for WooCommerce plugin < 1.0.6 - Unauthenticated Order Payment Forgery vulnerability

Unauthenticated Order Payment Forgery vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc, Naoki Kawahigashi in WordPress Plugin Paymentfor Gateway for WooCommerce versions 1.0.6...

CVE-2026-103307 Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhook

The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL...

CVE-2026-103307

The Walletdoc Payment Gateway for WooCommerce WordPress plugin, in versions prior to 1.8.5 , is vulnerable to unauthenticated SQL injection and order payment forgery . The root cause is a failure to properly sanitize and escape user input before using it in SQL statements, combined with a default...