CVE-2026-103301

The Payment Gateway for Telcell WordPress plugin (versions before 2.0.5 ) is vulnerable to unauthenticated payment confirmation forgery . The root cause is an empty-by-default merchant secret used to sign incoming payment notifications, which the plugin fails to properly verify. An unauthenticate...

CVE-2026-103301 Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret

The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because the secret used to sign them is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary WooCommerce orders as pai...

CVE-2026-103301 Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret

The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because the secret used to sign them is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary WooCommerce orders as pai...

WordPress Payment Gateway for Telcell plugin < 2.0.5 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Payment Gateway for Telcell versions 2.0.5...

CVE-2026-111957 SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via Redirect Callback

The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being completed, nor check the payment amount against the order total, allowing unauthenticated users to mark a pending order as paid by replaying a payment...

CVE-2026-111957

The SUMIT Payment Gateway for WooCommerce WordPress plugin (versions before 4.0.0 ) is vulnerable to an unauthenticated payment confirmation forgery . The flaw exists because the plugin fails to bind confirmed payments to specific orders and does not verify the payment amount against the order to...

CVE-2026-111957 SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via Redirect Callback

The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being completed, nor check the payment amount against the order total, allowing unauthenticated users to mark a pending order as paid by replaying a payment...

WordPress SUMIT Payment Gateway for WooCommerce plugin < 4.0.0 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin SUMIT Payment Gateway for WooCommerce versions 4.0.0...

CVE-2026-103302 Payment Gateway for Idram < 2.1.6 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret

The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark...

CVE-2026-103302

The Payment Gateway for Idram WordPress plugin (versions before 2.1.6 ) is vulnerable to an unauthenticated payment confirmation forgery. The root cause is that the plugin fails to verify the authenticity of incoming payment notifications because the merchant credentials used for checksum computa...

CVE-2026-103302 Payment Gateway for Idram < 2.1.6 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret

The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark...

WordPress Payment Gateway for Idram plugin < 2.1.6 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Payment Gateway for Idram versions 2.1.6...

WordPress BDM Digital Payment Gateway plugin 1.2.7-1.3.12 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin BDM Digital Payment Gateway versions 1.2.7-1.3.12...

CVE-2026-86791 iPOSpays Payment Gateway for WooCommerce < 1.4.7 - Unauthenticated Payment Confirmation Forgery

The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually completed before recording an order as paid, allowing unauthenticated users to mark any unpaid order as paid and to rewrite its total...

CVE-2026-86791

The iPOSpays Payment Gateway for WooCommerce WordPress plugin, in versions prior to 1.4.7 , is vulnerable to an unauthenticated payment confirmation forgery . The root cause is a failure to verify that a payment was actually completed before recording an order as paid. This allows unauthenticated...

CVE-2026-106010 BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation Forgery

The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default...

CVE-2026-106010 BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation Forgery

The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default...

CVE-2026-106010

The BDM Digital Payment Gateway WordPress plugin (versions 1.2.7 through 1.3.12 ) contains a vulnerability where the public payment-status update route fails to verify credentials. Because the system treats unset credentials as valid, unauthenticated attackers can forge payment confirmations and ...

CVE-2026-94273 Snap Finance <= 3.11.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_complete_payment

The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment...

CVE-2026-94273

The Snap Finance WordPress plugin (versions through 3.11.0 ) is vulnerable to an unauthenticated payment confirmation forgery. The root cause is a failure to verify that the payment provider's response confirms a completed and approved transaction before marking a WooCommerce order as paid. This ...