EUVD-2026-116911

wePOS Point Of Sale for WooCommerce before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the...

CVE-2026-121993

The wePOS (Point Of Sale for WooCommerce) plugin versions before 2.0.3 is susceptible to a missing authorization vulnerability in the wepos/v1/payment/process REST route. This flaw allows authenticated vendor-level users, such as Dokan vendor staff with the publish_shop_orders capability, to mani...

PT-2026-136969

wePOS Point Of Sale for WooCommerce before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the publish...

CVE-2026-121993: wedevs wePOS – Point Of Sale (POS) for WooCommerce & Dokan: wePOS (Point Of Sale for WooCommerce) before 2.0.3 contains a missing authorization vulnerability in the…

wePOS Point Of Sale for WooCommerce before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the...

WS-2021-0067

Impact After order payment process manipulation Patches We recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6 Workarounds For older versions of...

CVE-2024-31802

DESIGNA ABACUS v.18 and before allows an attacker to bypass the payment process via a crafted QR code...

CVE-2024-31802: Authentication Bypass by Spoofing

DESIGNA ABACUS v.18 and before allows an attacker to bypass the payment process via a crafted QR code...

PT-2024-24212 · Unknown · Designa Abacus

Name of the Vulnerable Software and Affected Versions: DESIGNA ABACUS versions prior to v.19 Description: The issue allows an attacker to bypass the payment process via a crafted QR code. Recommendations: For versions prior to v.19, update to a version that includes a fix for this issue to preven...

CVE-2024-31802

DESIGNA ABACUS v.18 and before allows an attacker to bypass the payment process via a crafted QR code...

CVE-2024-31802

DESIGNA ABACUS versions v.18 and before (prior to v.19) are vulnerable to a flaw that allows an attacker to bypass the payment process using a crafted QR code . To remediate this vulnerability, users should update to a version that includes a fix. As a temporary workaround, organizations may cons...

TrueLayer.Client SSRF when fetching payment or payment provider

Impact The vulnerability could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to unexpected resources on local networks or to the internet could be made which could lead to informatio...

GHSA-5PQ5-9PHV-Q5J3 CardGate Payments plugin for WooCommerce does not validate request origin

An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings merchant ID, secret key, etc. and therefore bypass...

CardGate Payments plugin for WooCommerce does not validate request origin

An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings merchant ID, secret key, etc. and therefore bypass...

PT-2021-24400

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 6.3.5.3 Description: The issue allows for manipulation after the order payment process. It is recommended to update to the latest version to ensure security. There are security measures available for older versions...

Google Chrome Security Bypass Vulnerability (CNVD-2020-29234)

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in Google Chrome prior to version 83.0.4103.61 that stems from insufficient policy enforcement during the payment process. The vulnerability can be exploited by an attacker to bypass security...

WordPress WooCommerce CardGate Payment Gateway 3.1.15 Plugin - Payment Process Bypass Exploit

Exploit for php platform in category web applications Exploit Title: WordPress Plugin WooCommerce CardGate Payment Gateway 3.1.15 - Payment Process Bypass Exploit Author: GeekHack Vendor Homepage: https://www.cardgate.com www.curopayments.com Software Link:...

Magento WooCommerce CardGate Payment Gateway 2.0.30 - Payment Process Bypass Exploit

Exploit for php platform in category web applications Exploit Title: Magento WooCommerce CardGate Payment Gateway 2.0.30 - Payment Process Bypass Exploit Author: GeekHack Vendor Homepage: https://www.cardgate.com www.curopayments.com Software Link:...

CVE-2020-8819

An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings merchant ID, secret key, etc. and therefore bypass...

Authentication flaw

An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings merchant ID, secret key, etc. and therefore bypass...

CVE-2020-8819

An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings merchant ID, secret key, etc. and therefore bypass...