179 matches found
WordPress Eupago Gateway For Woocommerce plugin 4.5.0-4.7.5 - Unauthenticated Payment Confirmation Bypass vulnerability
Unauthenticated Payment Confirmation Bypass vulnerability discovered by Seongwon Lee in WordPress Plugin Eupago Gateway For Woocommerce versions 4.5.0-4.7.5...
CVE-2026-91075
The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark a pending order as paid without payin...
CVE-2026-91075
The Eupago Gateway For Woocommerce WordPress plugin, versions 4.5.0 through 4.7.5 , is vulnerable to an unauthenticated payment confirmation bypass . In certain configurations, the plugin fails to verify the authenticity of incoming payment-confirmation webhook requests. This allows an unauthenti...
CVE-2026-91075 Eupago Gateway For Woocommerce 4.5.0 - 4.7.5 - Unauthenticated Payment Confirmation Bypass
The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark a pending order as paid without payin...
EUVD-2026-115719
The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark a pending order as paid without payin...
CVE-2026-103310
The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without...
EUVD-2026-115103
The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without...
CVE-2026-103310: Unknown PayHere Payment Gateway: The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment…
The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without...
PT-2026-135355
The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without...
WordPress Sadad QA Payment plugin <= 1.28 - Unauthenticated Arbitrary Order Payment Confirmation vulnerability
Unauthenticated Arbitrary Order Payment Confirmation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Sadad QA Payment versions = 1.29...
WordPress Casso Flow plugin < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation vulnerability
Unauthenticated WooCommerce Order Payment Confirmation vulnerability discovered by Pedro Pinho in WordPress Plugin Casso Flow versions 4.2.0...
CVE-2026-103330
The Sadad QA Payment WordPress plugin (version 1.28 and earlier) is vulnerable to an unauthenticated arbitrary order payment confirmation via a signature bypass . The root cause is that the plugin fails to correctly verify incoming payment notifications because the verification is keyed on a merc...
CVE-2026-103330 Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature Bypass
The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the verification is keyed on a merchant secret that is empty by default and the rest of the signed data is attacker-controlled, allowing unauthenticated attackers to...
CVE-2026-103330 Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature Bypass
The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the verification is keyed on a merchant secret that is empty by default and the rest of the signed data is attacker-controlled, allowing unauthenticated attackers to...
EUVD-2026-111969
The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount, allowing an unauthenticated attacker who holds a single genuine low-value transaction to mark arbitrary...
CVE-2026-103382
The Casso Flow WordPress plugin, versions prior to 4.2.0 , contains a vulnerability where it fails to properly authenticate incoming bank-transfer payment notifications. On a default installation, the verification token is empty, which allows unauthenticated attackers to forge notifications and m...
CVE-2026-103382 Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation
The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation, allowing unauthenticated attackers to forge a notification and mark any pending WooCommerce order as paid,...
CVE-2026-103330: Unknown Sadad QA Payment: The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment…
The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the verification is keyed on a merchant secret that is empty by default and the rest of the signed data is attacker-controlled, allowing unauthenticated attackers to...
PT-2026-128085
The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount, allowing an unauthenticated attacker who holds a single genuine low-value transaction to mark arbitrary...
WordPress Payex Payment Gateway for Woocommerce plugin <= 1.2.10 - Unauthenticated Payment Confirmation Forgery vulnerability
Unauthenticated Payment Confirmation Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Payex Payment Gateway for Woocommerce versions = 1.2.10...