CVE-2026-103517

The Airwallex Online Payments Gateway WordPress plugin, in versions prior to 1.36.0 , is vulnerable to an unauthenticated payment bypass. The root cause is a failure to verify the authenticity of incoming payment notifications when no webhook secret is configured. This allows unauthenticated atta...

WordPress Nexi XPay Build plugin <= 7.6.2 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, Iñigo Sánchez Enciso in WordPress Plugin Nexi XPay Build versions = 7.6.2...

CVE-2026-82212 Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Bypass via NPG Notification Handler

The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid...

CVE-2026-82212 Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Bypass via NPG Notification Handler

The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid...

CVE-2026-82212

The Nexi XPay Build WordPress plugin (version 7.6.2 and below ) contains a vulnerability where the payment notification route fails to correctly validate the security token. Specifically, the plugin accepts requests when the target order lacks a stored token. This allows unauthenticated attackers...

WordPress Deema Payment Gateway plugin <= 1.1.2 - Unauthenticated Payment Bypass and Order Manipulation vulnerability

Unauthenticated Payment Bypass and Order Manipulation vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Deema Payment Gateway versions = 1.1.2...

CVE-2026-94270 Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass and Order Manipulation via Webhook

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification disabled by default, allowing unauthenticated attackers to mark an unpaid order as paid, or to cancel or refund an existing order...

CVE-2026-94270

The Deema Payment Gateway WordPress plugin (versions

CVE-2026-94270 Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass and Order Manipulation via Webhook

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification disabled by default, allowing unauthenticated attackers to mark an unpaid order as paid, or to cancel or refund an existing order...

WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability

Payment Bypass vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin GiveWP versions = 4.16.8.1...

WordPress MStore API plugin 4.21.1-4.22.0 - Subscriber+ Payment Bypass vulnerability

Subscriber+ Payment Bypass vulnerability discovered by cyberkareem in WordPress Plugin MStore API versions 4.21.1-4.22.0...

CVE-2026-97219 MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' Parameter

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying...

CVE-2026-97219 MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' Parameter

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying...

WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability

Payment Bypass vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Forminator versions = 1.57.2...

WordPress Verge3D Publishing and E-Commerce plugin 4.1.0-4.13.0 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, Iñigo Sánchez Enciso in WordPress Plugin Verge3D versions 4.1.0-4.13.0...

WordPress Paymattic plugin 4.6.20-4.6.25 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Artus KG in WordPress Plugin Best Payments Plugin for WP versions 4.6.20-4.6.25...

WordPress Bookly plugin < 28.3 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by vuxvinh in WordPress Plugin Bookly versions 28.3...

CVE-2026-86838

The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step...

CVE-2026-92996 Verge3D 4.1.0 - 4.13.0 - Unauthenticated Payment Bypass via v3d_payment_done

The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing unauthenticated users to mark any order as paid...

CVE-2026-92996

The Verge3D WordPress plugin (versions 4.1.0 through 4.13.0 ) contains a vulnerability where it fails to verify payments with the payment provider and lacks order ownership checks. This allows unauthenticated users to mark any order as paid via the v3d_payment_done functionality. No specific reme...