CVE-2026-94361 PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned Callback

The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed, allowing unauthenticated attackers to change the payment status of any order in the store regardless of...

CVE-2026-94361

The Payable Payment Gateway for WooCommerce WordPress plugin, versions before 1.3.1 , is vulnerable to an unauthenticated order payment forgery due to a missing authorization check. The plugin fails to verify the authenticity of incoming payment notifications, which allows unauthenticated attacke...

WordPress Payable Payment Gateway for WooCommerce plugin < 1.3.1 - Unauthenticated Order Payment Forgery vulnerability

Unauthenticated Order Payment Forgery vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Payable Payment Gateway for WooCommerce versions 1.3.1...

WordPress UniPAY Payment Gateway For WooCommerce plugin <= 2.3 - Unauthenticated Order Payment Forgery vulnerability

Unauthenticated Order Payment Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin UniPAY Payment Gateway For WooCommerce versions = 2.3...

CVE-2026-103331

The UniPAY Payment Gateway For WooCommerce WordPress plugin, in versions through 2.3 , contains a vulnerability where it fails to properly verify the authenticity of payment notifications. The root cause is that signatures are checked against a merchant secret which is empty by default. This flaw...

CVE-2026-103331 UniPAY Payment Gateway For WooCommerce <= 2.3 - Unauthenticated Order Payment Forgery via Empty IPN Secret

The UniPAY Payment Gateway For WooCommerce WordPress plugin through 2.3 does not properly verify the authenticity of payment notifications, as their signature is checked against a merchant secret that is empty by default, allowing unauthenticated attackers to forge a valid notification and mark...

WordPress TiendaCrypto para WooCommerce plugin 1.0.1-1.2.1 - Unauthenticated Order Payment Forgery vulnerability

Unauthenticated Order Payment Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin TiendaCrypto para WooCommerce versions 1.0.1-1.2.1...

CVE-2026-103325 TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery via Webhook HMAC Bypass

The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary...

CVE-2026-103325

The TiendaCrypto para WooCommerce WordPress plugin (versions through 1.2.1 ) contains a vulnerability where it fails to correctly verify the authenticity of its payment webhooks. The root cause is that the plugin validates the request signature against a key that is consistently empty . This flaw...

WordPress Eurobank WooCommerce Payment Gateway plugin <= 2.1.1 - Unauthenticated Order Payment Forgery vulnerability

Unauthenticated Order Payment Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Eurobank WooCommerce Payment Gateway versions = 2.1.1...

CVE-2026-103300 Eurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery via Unverified Callback

The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending...

CVE-2026-103300 Eurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery via Unverified Callback

The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending...

CVE-2026-103300

The Eurobank WooCommerce Payment Gateway WordPress plugin (versions up to and including 2.1.1 ) is vulnerable to an unauthenticated order payment forgery . The root cause is the failure to verify that payment-confirmation requests originate from the legitimate payment provider, compounded by a de...

CVE-2026-103306 iKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via Callback

The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any...

CVE-2026-103306

The Online Payments with iK Pay Gateway WordPress plugin (versions before 3.0.4 ) is vulnerable to an Unauthenticated Order Payment Forgery vulnerability. The flaw exists because the plugin fails to properly verify the authenticity of its payment gateway callback on a default installation. This a...

WordPress Online Payments with iK Pay Gateway plugin < 3.0.4 - Unauthenticated Order Payment Forgery vulnerability

Unauthenticated Order Payment Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Online Payments with iK Pay Gateway versions 3.0.4...

CVE-2026-103306 iKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via Callback

The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any...

WordPress Cardinity Payment Gateway for WooCommerce plugin 3.2.6-3.4.1 - Unauthenticated Arbitrary Order Payment Forgery vulnerability

Unauthenticated Arbitrary Order Payment Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Cardinity Payment Gateway for WooCommerce versions 3.2.6-3.4.1...

CVE-2026-103324 Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Project Secret

The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mar...

CVE-2026-103324

The Cardinity Payment Gateway for WooCommerce WordPress plugin versions prior to 3.4.2 is vulnerable to unauthenticated payment notification forgery. The root cause is that the plugin does not properly verify the authenticity of received notifications because the signing secret is empty by defaul...