CVE-2026-105992

The Ettrick Escape Room Booking WordPress plugin (versions prior to 1.3.1 ) is vulnerable to an unauthenticated payment confirmation bypass. The software fails to verify a booking's payment status against the external payment provider before marking it as paid and confirmed . This flaw allows una...

CVE-2026-105992 Ettrick Escape Room Booking < 1.3.1 - Unauthenticated Payment Confirmation Bypass

The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking it paid and confirmed, allowing unauthenticated attackers to mark bookings as paid without paying...

CVE-2026-84043

The ePayco Payment Gateway for WooCommerce WordPress plugin, in versions before 8.4.7 , fails to properly verify the authenticity of payment confirmation requests. This allows unauthenticated attackers to mark orders as paid without presenting a valid gateway signature, resulting in a low integri...