WordPress Robokassa payment gateway for Woocommerce plugin < 1.8.9 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin Robokassa payment gateway for Woocommerce versions 1.8.9...

CVE-2026-54608

MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicaldashstripepayments before Stripe checkout succeeds and embeds the payment code in the success redirect, while GET...

CVE-2026-54608 MythicalDash: Unauthenticated payment bypass in Stripe success-redirect endpoint allows arbitrary free credit top-up

MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicaldashstripepayments before Stripe checkout succeeds and embeds the payment code in the success redirect, while GET...

CVE-2026-54608 MythicalDash: Unauthenticated payment bypass in Stripe success-redirect endpoint allows arbitrary free credit top-up

MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicaldashstripepayments before Stripe checkout succeeds and embeds the payment code in the success redirect, while GET...

CVE-2026-16582

The Booking for Appointments and Events Calendar – Amelia WordPress plugin is vulnerable to unauthenticated payment bypass in versions up to and including 2.4.5 . The root cause is that the plugin accepts a client-supplied package-redemption identifier as proof of payment without properly validat...

CVE-2026-16582 Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating...

WordPress WP Events Manager plugin < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR vulnerability

Unauthenticated Payment Bypass and Booking Status Update via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Events Manager versions 2.2.5...

WordPress Five Star Restaurant Reservations plugin < 2.7.23 - Unauthenticated Payment Bypass and Booking Confirmation via IDOR vulnerability

Unauthenticated Payment Bypass and Booking Confirmation via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Five Star Restaurant Reservations versions 2.7.23...

WordPress Booking for Appointments and Events Calendar – Amelia plugin <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass vulnerability

Missing Authorization to Unauthenticated Payment Bypass vulnerability discovered by ricky morty in WordPress Plugin Amelia versions = 2.4.5...

CVE-2026-91017 Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT Callback

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders...

CVE-2026-91017 Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT Callback

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders...

CVE-2026-90922

The Paid Membership Subscriptions WordPress plugin (versions before 3.0.9 ) contains an Improper Access Control vulnerability. The software fails to verify if the amount and currency reported by the payment provider match the pending payment details before completing the transaction. This allows ...

CVE-2026-90922 Paid Member Subscriptions < 3.0.9 - Unauthenticated Membership Payment Bypass via PayPal Standard Amount and Currency Mismatch

The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated users to obtain a paid membership by paying an arbitrary lower amount...

CVE-2026-90922 Paid Member Subscriptions < 3.0.9 - Unauthenticated Membership Payment Bypass via PayPal Standard Amount and Currency Mismatch

The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated users to obtain a paid membership by paying an arbitrary lower amount...

PT-2026-95143

Name of the Vulnerable Software and Affected Versions MythicalDash versions prior to 3.5.4-aurora Description An unauthenticated payment bypass exists in the Stripe success-redirect mechanism. The endpoint '/api/stripe/process' creates a pending payment record before checkout is completed and...

WordPress Eventin plugin < 4.1.24 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by cyberkareem in WordPress Plugin WP Event Solution versions 4.1.24...

CVE-2026-84906 Eventin < 4.1.24 - Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transaction Replay

The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway reports the transaction as successful, not its amount, currency, or which order it belongs to, allowing unauthenticated visitors ...

CVE-2026-84906

Eventin WordPress plugin versions before 4.1.24 contain an unauthenticated payment bypass affecting its Stripe and PayPal integrations. The plugin fails to verify that a completed payment corresponds to the specific order it is applied to, checking only that the gateway reports the transaction as...

CVE-2026-84906 Eventin < 4.1.24 - Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transaction Replay

The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway reports the transaction as successful, not its amount, currency, or which order it belongs to, allowing unauthenticated visitors ...

CVE-2026-77702 Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token

The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge...