PT-2026-97303

Name of the Vulnerable Software and Affected Versions SUMIT Payment Gateway for WooCommerce WordPress plugin versions prior to 4.0.0 Description The plugin fails to verify the authenticity of payment notifications with the payment provider before marking an order as paid. This allows...

CVE-2026-84091: Improper Authentication

The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment...

CVE-2026-95527: Missing Authorization

Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...

PT-2026-97480

Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...

CVE-2026-87981: Missing Authorization

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment...

PT-2026-97448

Name of the Vulnerable Software and Affected Versions PayPlus Payment Gateway versions prior to 8.2.6 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 8.2.5...

CVE-2026-93620: Missing Authorization

Unauthenticated Broken Access Control in PayPlus Payment Gateway = 8.2.5 versions...

CVE-2026-92400

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated user...

EUVD-2026-83870

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated user...

CVE-2026-92400 Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via Sandbox IPN Environment Confusion

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated user...

CVE-2026-92400

The Payment Gateway for PayPal on WooCommerce WordPress plugin (before version 9.2.1 ) fails to verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order as complete. This allows una...

CVE-2026-92400 Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via Sandbox IPN Environment Confusion

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated user...

CVE-2026-92400: Insufficient Verification of Data Authenticity

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated user...

PT-2026-96060

Name of the Vulnerable Software and Affected Versions Payment Gateway for PayPal on WooCommerce WordPress plugin versions prior to 9.2.1 Description An issue exists where the plugin fails to verify if an incoming payment notification was confirmed within the store's configured payment environment...

CVE-2026-9832

The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible woocommerceapiwtstripe webhook endpoint EHStripeWebhookHandler::handle wrapping...

CVE-2026-9832 Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint

The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible woocommerceapiwtstripe webhook endpoint EHStripeWebhookHandler::handle wrapping...

CVE-2026-9832

The Payment Gateway of Stripe for WooCommerce WordPress plugin (all versions up to and including 5.0.8 ) is vulnerable to improper verification of cryptographic signature . The publicly accessible woocommerce_api_wt_stripe webhook endpoint wraps its sole call to \Stripe\Webhook::constructEvent() ...

CVE-2026-9832 Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint

The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible woocommerceapiwtstripe webhook endpoint EHStripeWebhookHandler::handle wrapping...

EUVD-2026-83540

The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible woocommerceapiwtstripe webhook endpoint EHStripeWebhookHandler::handle wrapping...

PT-2026-95797

Name of the Vulnerable Software and Affected Versions Payment Gateway of Stripe for WooCommerce versions prior to 5.0.9 Description Improper Verification of Cryptographic Signature occurs due to the woocommerce api wt stripe webhook endpoint EH Stripe Webhook Handler::handle failing to execute th...