CVE-2026-87837

The Wava Payment Plugin for WordPress (versions before 0.3.10 ) is vulnerable to an unauthenticated order status change due to a failure to verify the authenticity of incoming payment-provider notifications. An unauthenticated attacker can manipulate any WooCommerce order status, such as marking ...

CVE-2026-87837 Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment Webhook

The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as...

CVE-2026-87837 Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment Webhook

The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as...

CVE-2026-94270

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification disabled by default, allowing unauthenticated attackers to mark an unpaid order as paid, or to cancel or refund an existing order...

EUVD-2026-92964

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification disabled by default, allowing unauthenticated attackers to mark an unpaid order as paid, or to cancel or refund an existing order...

PT-2026-106338

Name of the Vulnerable Software and Affected Versions Deema Payment Gateway versions prior to 1.1.3 Description The Deema Payment Gateway WordPress plugin fails to verify the authenticity of incoming payment provider notifications. Because this verification is disabled by default, unauthenticated...

PT-2026-68640

Name of the Vulnerable Software and Affected Versions Payment Gateway for Redsys & WooCommerce Lite WordPress plugin versions prior to 7.0.2 Description The plugin fails to verify the authenticity of incoming payment-provider notifications for a specific payment method before marking orders as...