CVE-2026-103300

The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending...

CVE-2026-103298

The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install, allowing unauthenticated attackers to for...

EUVD-2026-109635

The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending...

CVE-2026-103300

The Eurobank WooCommerce Payment Gateway WordPress plugin (versions up to and including 2.1.1 ) is vulnerable to an unauthenticated order payment forgery . The root cause is the failure to verify that payment-confirmation requests originate from the legitimate payment provider, compounded by a de...

EUVD-2026-109618

The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install, allowing unauthenticated attackers to for...

CVE-2026-103299

The nexi Alpha Bank for WooCommerce WordPress plugin (versions

CVE-2026-103319 OPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Confirmation Forgery via Empty Default Secret Key

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and...

CVE-2026-103319

The OPay Payment Gateway for WooCommerce WordPress plugin (versions

CVE-2026-103299 nexi Alpha Bank for WooCommerce <= 2.2.0 - Unauthenticated Payment Confirmation Forgery via Empty Shared Secret

The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the...

WordPress OPay Payment Gateway for WooCommerce plugin <= 2.5.5 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin OPay Payment Gateway for WooCommerce versions = 2.5.5...

CVE-2026-94295

The Chikkili- Google Pay India for Woocommerce WordPress plugin versions through 1.0.6 (prior to 1.0.7) contains an Unauthenticated Payment Confirmation Forgery vulnerability (CWE-862). The root cause is a failure to verify that payment notifications actually originate from the legitimate payment...

CVE-2026-94295 Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forgery via Unverified Signature

The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before marking the associated order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without any...

WordPress Chikkili- Google Pay India for Woocommerce plugin <= 1.0.6 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Pedro Pinho in WordPress Plugin Chikkili- Google Pay India for Woocommerce versions = 1.0.6...

WordPress Ettrick Escape Room Booking plugin < 1.3.1 - Unauthenticated Payment Confirmation Bypass vulnerability

Unauthenticated Payment Confirmation Bypass vulnerability discovered by ryan fabella in WordPress Plugin Ettrick Escape Room Booking versions 1.3.1...

CVE-2026-103301

The Payment Gateway for Telcell WordPress plugin (versions before 2.0.5 ) is vulnerable to unauthenticated payment confirmation forgery . The root cause is an empty-by-default merchant secret used to sign incoming payment notifications, which the plugin fails to properly verify. An unauthenticate...

CVE-2026-103301 Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret

The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because the secret used to sign them is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary WooCommerce orders as pai...

CVE-2026-103301 Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret

The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because the secret used to sign them is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary WooCommerce orders as pai...

WordPress Payment Gateway for Telcell plugin < 2.0.5 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Payment Gateway for Telcell versions 2.0.5...

CVE-2026-103302

The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark...

CVE-2026-111957 SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via Redirect Callback

The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being completed, nor check the payment amount against the order total, allowing unauthenticated users to mark a pending order as paid by replaying a payment...