12 matches found
WordPress CamPay Shortcode Payment Gateway plugin < 1.7 - Unauthenticated Payment Status Forgery vulnerability
Unauthenticated Payment Status Forgery vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin CamPay Shortcode Payment Gateway versions 1.7...
CVE-2026-105975 CamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forgery via external_reference
The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parameters, allowing unauthenticated attackers to mark payment records as paid, destroy genuine payment...
CVE-2026-105975
The CamPay Shortcode Payment Gateway WordPress plugin, in versions before 1.7 , is vulnerable to an unauthenticated payment status forgery vulnerability. The root cause is a failure to verify the authenticity of Mobile Money payment confirmations , as the plugin derives payment results from clien...
CVE-2026-84169 UPI QR Code Payment Gateway <= 1.4.3 - Unauthenticated Cross-Order Payment-Status Forgery
The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment...
CVE-2026-84169
The UPI QR Code Payment Gateway WordPress plugin, affecting versions through 1.4.3 , contains a vulnerability where it fails to verify if a payment-confirmation request belongs to the specific order and customer it claims to confirm. This lack of authorization allows unauthenticated attackers to ...
CVE-2026-84169 UPI QR Code Payment Gateway <= 1.4.3 - Unauthenticated Cross-Order Payment-Status Forgery
The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment...
WordPress UPI QR Code Payment Gateway plugin <= 1.4.3 - Unauthenticated Cross-Order Payment-Status Forgery vulnerability
Unauthenticated Cross-Order Payment-Status Forgery vulnerability discovered by Pedro Pinho in WordPress Plugin UPI QR Code Payment Gateway versions = 1.4.3...
CVE-2026-68500 Sylius Mollie Plugin: Payment status forgery via the payment webhook
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /locale/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the...
CVE-2026-68500 Sylius Mollie Plugin: Payment status forgery via the payment webhook
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /locale/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the...
CVE-2026-5050 Payment Gateway for Redsys & WooCommerce Lite <= 7.0.0 - Improper Verification of Cryptographic Signature to Unauthenticated Payment Status Manipulation
The Payment Gateway for Redsys & WooCommerce Lite plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 7.0.0 due to successfulrequest handlers calculating a local signature but not validating DsSignature from the request before...
CVE-2025-13384
The CP Contact Form with PayPal plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.56. This is due to the plugin exposing an unauthenticated IPN-like endpoint via the 'cpcontactformppipncheck' query parameter that processes payment confirmations...