WordPress PayDunya WooCommerce Payment Gateway plugin <= 1.1.6 - Unauthenticated Order Payment Completion vulnerability

Unauthenticated Order Payment Completion vulnerability discovered by Naoki Kawahigashi in WordPress Plugin PayDunya WooCommerce Payment Gateway versions = 1.1.6...

CVE-2026-103359 PayDunya WooCommerce Payment Gateway 1.1.6 - Unauthenticated Order Payment Completion via Webhook Forgery

The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming payment notifications and, until the gateway is configured, authenticates them with a value derived from an empty secret that anyone can compute, allowing unauthenticated attackers...

CVE-2026-103359

The PayDunya WooCommerce Payment Gateway WordPress plugin, version 1.1.6 and below , contains a vulnerability where it fails to verify the authenticity of incoming payment notifications. Until the gateway is configured, the plugin authenticates these notifications using a value derived from an em...

WordPress Mintpay for WooCommerce plugin <= 2.2.3 - Unauthenticated Order Payment Completion and Cancellation vulnerability

Unauthenticated Order Payment Completion and Cancellation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Mintpay for WooCommerce versions = 2.2.3...

WordPress CCAvenue Payment Gateway for WooCommerce plugin <= 3.1 - Unauthenticated Order Payment Completion vulnerability

Unauthenticated Order Payment Completion vulnerability discovered by Naoki Kawahigashi in WordPress Plugin CCAvenue Payment Gateway for WooCommerce versions = 3.1...

CVE-2026-103298 CCAvenue Payment Gateway for WooCommerce <= 3.1 - Unauthenticated Order Payment Completion via Webhook Forgery

The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install, allowing unauthenticated attackers to for...

CVE-2026-103298

The CCAvenue Payment Gateway for WooCommerce WordPress plugin (versions through 3.1 ) is vulnerable to an unauthenticated order payment completion vulnerability via webhook forgery . The flaw exists because the plugin fails to verify if payment-confirmation requests genuinely originate from the p...

CVE-2026-103298 CCAvenue Payment Gateway for WooCommerce <= 3.1 - Unauthenticated Order Payment Completion via Webhook Forgery

The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install, allowing unauthenticated attackers to for...

WordPress WP Stripe Checkout plugin < 1.2.2.62 - Unauthenticated Forged Payment Completion vulnerability

Unauthenticated Forged Payment Completion vulnerability discovered by Naoki Kawahigashi in WordPress Plugin WP Stripe Checkout versions 1.2.2.62...

WordPress Gateway for Vantiv on WC plugin <= 1.0.1 - Unauthenticated Order Payment Completion vulnerability

Unauthenticated Order Payment Completion vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin Gateway for Vantiv on WC versions = 1.0.1...

CVE-2026-106014 Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback Forgery

The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hosted-payment return handler, allowing unauthenticated attackers to mark orders as paid without actually paying...

CVE-2026-106014

The Gateway for Vantiv on WC WordPress plugin, affecting versions through 1.0.1 , contains a vulnerability where it fails to verify the authenticity of payment notifications received via its hosted-payment return handler . This lack of validation allows unauthenticated attackers to perform a paym...

CVE-2026-106014 Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback Forgery

The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hosted-payment return handler, allowing unauthenticated attackers to mark orders as paid without actually paying...

WordPress Trust Payments Gateway for WooCommerce plugin < 3.1.0 - Unauthenticated Order Payment Completion vulnerability

Unauthenticated Order Payment Completion vulnerability discovered by ryan fabella in WordPress Plugin Trust Payments Gateway for WooCommerce versions 3.1.0...

CVE-2026-87843

The Trust Payments Gateway for WooCommerce WordPress plugin versions prior to 3.1.0 is vulnerable to an unauthenticated order payment completion flaw. The plugin fails to verify the authenticity of the payment provider's response when a customer returns from a hosted payment page. Furthermore, it...

CVE-2026-87843 Trust Payments Gateway for WooCommerce < 3.1.0 - Unauthenticated Order Payment Completion via Payment Return Page

The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from the hosted payment page, nor bind that response to the targeted order or check the amount, allowing unauthenticated attackers t...

WordPress Nexi XPay Build plugin <= 7.6.2 - Unauthenticated Payment Completion and Order Key Disclosure vulnerability

Unauthenticated Payment Completion and Order Key Disclosure vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Nexi XPay Build versions = 7.6.2...

CVE-2026-82211 Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Completion and Order Key Disclosure

The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details...

CVE-2026-82211 Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Completion and Order Key Disclosure

The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details...

CVE-2026-82211

The Nexi XPay Build WordPress plugin through version 7.6.2 is vulnerable to unauthenticated payment completion and order key disclosure. The root cause is a failure to verify the payment result supplied to several unauthenticated routes. This allows an attacker to mark arbitrary orders as paid or...