WordPress Payment Gateway for PayPal on WooCommerce plugin < 9.2.1 - Unauthenticated Payment Bypass via PayPal Advanced Return Handler vulnerability

Unauthenticated Payment Bypass via PayPal Advanced Return Handler vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Payment Gateway for PayPal on WooCommerce versions 9.2.1...

Payment Gateway for Telcell < 2.0.4 - Open Redirect

The plugin does not validate the apiurl parameter before redirecting the user to its value, leading to an Open Redirect issue id: CVE-2023-6786 info: name: Payment Gateway for Telcell 2.0.4 - Open Redirect author: s4e-io severity: medium description: | The plugin does not validate the apiurl...

CVE-2026-66431

Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce via CLINK = 1.0.7 versions...

EUVD-2026-57864

Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce via CLINK = 1.0.7 versions...

CVE-2026-66431

Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce via CLINK = 1.0.7 versions...

CVE-2026-66431

CVE-2026-66431 concerns the WordPress plugin WordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) with versions up to 1.0.7. The issue is Unauthenticated Broken Access Control, meaning an attacker can access restricted functionality without authentication. The description and c...

CVE-2026-66431 WordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) plugin <= 1.0.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce via CLINK = 1.0.7 versions...

Dissecting the JWR phishing framework

Cisco Talos recently identified an undocumented phishing framework, internally branded "JWR" by its developer, built to convincingly impersonate checkout and login pages across major payment and shopping platforms. The client engine of the JWR phishing framework is a real-time, operator-driven...

PT-2026-71551

Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce via CLINK = 1.0.7 versions...

CVE-2026-16621 Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via PayPal Advanced Return Handler

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes t...

EUVD-2026-57173

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes t...

CVE-2026-16621

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes t...

PT-2026-71052

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes t...

EUVD-2026-51407

The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled...

CVE-2026-13692 PayU CommercePro < 3.9.0 - Unauthenticated Order Tampering

The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders...

CVE-2026-12493

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrar...

CVE-2026-12493 Clover Payment Gateway by Zaytech for WooCommerce < 1.3.6 - Unauthenticated Payment Bypass via check_order

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrar...

CVE-2026-12493

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin is affected up to version 1.3.6. The vulnerability stems from insufficient verification of external payment records: an approved payment may not be tied to the correct WooCommerce order, and the paid amount may not be validate...

EUVD-2026-48199

Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce = 9.1.4 versions...

EUVD-2026-45887

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to...