EUVD-2026-57172

The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or...

CVE-2026-15213

The CVE concerns the Welcart e-Commerce WordPress plugin prior to 2.11.33. The vulnerability lies in the settlement callback for convenience-store/bank-transfer payments, where there is no authenticity verification. An unauthenticated request can flip an order from unpaid to settled using only an...

EUVD-2026-57171

The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkou...

CVE-2026-16538

The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value...

EUVD-2026-57089

The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value...

PT-2026-71052

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes t...

CVE-2026-17012

The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order...

CVE-2026-17012

The CVE-2026-17012 affects the WordPress plugin “Accept PayPal & Stripe with Subscriptions for WooCommerce” up to version 3.1.0. The underlying issue is that the plugin does not verify that the PayPal account receiving a payment matches the merchant’s configured account before marking the order a...

CVE-2026-17016

The CVE-2026-17016 entry concerns the WordPress plugin “Accept PayPal & Stripe with Subscriptions for WooCommerce” (versions up to 3.1.0). The vulnerability arises in the PayPal Data Transfer (PDT) return handler, which does not validate that the amount paid matches the order total, enabling a cu...

WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability

Payment Bypass vulnerability discovered by Alexis Lafontaine in WordPress Plugin SMEPay: UPI Gateway for WooCommerce versions = 1.0.5...

CVE-2026-15211

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is...

CVE-2026-15211 Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is...

CVE-2026-15148

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-16038 MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways

The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services...

CVE-2026-14205

CVE-2026-14205 affects the WP Events Manager WordPress plugin prior to 2.2.5. The vulnerability arises because the plugin does not validate the requested quantity when registering for paid events, and the price is computed from attacker-controlled quantity. This allows any authenticated user to c...

CVE-2026-14205 WP Events Manager < 2.2.5 - Subscriber+ Payment Bypass via 'qty' Parameter

The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment...

EUVD-2026-54302

The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the order being marked as paid, nor does it verify the authenticity of its payment-completion request, allowing unauthenticated attackers to reuse a single valid...

CVE-2026-19127

An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting insufficient cryptographic validation or lack of server-side state verification on promotional/lifetime-deal LTD redemption codes, an unauthenticated attacker...

CVE-2026-13399

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments...

CVE-2026-16067 Event Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via Client-Controlled Ticket Price

The Event Booking Manager for WooCommerce Pro WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native non-WooCommerce checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows...