CVE-2026-81740 Paytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment Callback

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of...

PT-2026-104126

Name of the Vulnerable Software and Affected Versions Dc Woocommerce Multi Vendor versions prior to 5.0.19 Description An issue exists where authenticated attackers with vendor-level access or higher specifically those with the edit stores capability can perform SQL Injection. This occurs because...

PT-2026-104115

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying...

CVE-2026-97219: Missing Authorization

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying...

CVE-2026-81740: Improper Authentication

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of...

CVE-2026-91020: External Control of Assumed-Immutable Web Parameter

The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amount server-side before using it as the cart-item price and store-credit coupon value, allowing unauthenticated users to submit an arbitrary or negative amount, bypassing the...

PT-2026-104113

The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amount server-side before using it as the cart-item price and store-credit coupon value, allowing unauthenticated users to submit an arbitrary or negative amount, bypassing the...

GO-2026-6584 Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace in github.com/klever-io/klever-go

Klever-Go: Zombie-order theft: Buy missing IsClaimed guard in native marketplace in github.com/klever-io/klever-go...

CVE-2026-103353

Incorrect Behavior Order vulnerability in WP ManageNinja LLC FluentForm fluentform allows Removing Important Client Functionality.This issue affects FluentForm: from n/a through 6.2.14...

EUVD-2026-90761

Incorrect Behavior Order vulnerability in WP ManageNinja LLC FluentForm fluentform allows Removing Important Client Functionality.This issue affects FluentForm: from n/a through 6.2.14...

CVE-2026-96173

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents...

WordPress Payments for Hubtel plugin < 1.0.2 - Unauthenticated Order Key Disclosure vulnerability

Unauthenticated Order Key Disclosure vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Payments for Hubtel versions 1.0.2...

CVE-2026-96173 Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents...

CVE-2026-96173 Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents...

CVE-2026-96173

The Payments for Hubtel WordPress plugin, in versions prior to 1.0.2 , contains an Insecure Direct Object Reference (IDOR) vulnerability. The flaw exists because the plugin fails to verify if a requester is authorized to view an order before redirecting a public payment-callback request. This all...

EUVD-2026-90518

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents...

CVE-2026-103538

A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderController.deleteOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component Order Deletion Endpoint. Performing a manipulation of the...

CVE-2026-103538 ZongXR SuperMarket Order Deletion Endpoint OrderController.java OrderController.deleteOrder missing authentication

A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderController.deleteOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component Order Deletion Endpoint. Performing a manipulation of the...

CVE-2026-103538 ZongXR SuperMarket Order Deletion Endpoint OrderController.java OrderController.deleteOrder missing authentication

A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderController.deleteOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component Order Deletion Endpoint. Performing a manipulation of the...

CVE-2026-103538

A security flaw exists in ZongXR SuperMarket 1.0.0.0 within the Order Deletion Endpoint component. Specifically, the OrderController.deleteOrder function located in order/src/main/java/com/supermarket/order/controller/OrderController.java fails to perform proper authentication. An attacker can pe...