CVE-2026-103310

The PayHere Payment Gateway WordPress plugin, versions 2.4.0 through 2.4.5 , is vulnerable to an unauthenticated payment bypass . The root cause is a failure to verify the authenticity of payment notifications when the merchant secret is unset, which is the default configuration. This allows an u...

CVE-2026-103310 PayHere Payment Gateway 2.4.0 - 2.4.5 - Unauthenticated Payment Bypass via Unverified Payment Notification

The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without...

CVE-2026-103310 PayHere Payment Gateway 2.4.0 - 2.4.5 - Unauthenticated Payment Bypass via Unverified Payment Notification

The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without...

PT-2026-135355

The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without...

CVE-2026-94361

The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed, allowing unauthenticated attackers to change the payment status of any order in the store regardless of...

CVE-2026-94361

The Payable Payment Gateway for WooCommerce WordPress plugin, versions before 1.3.1 , is vulnerable to an unauthenticated order payment forgery due to a missing authorization check. The plugin fails to verify the authenticity of incoming payment notifications, which allows unauthenticated attacke...

CVE-2026-94361 PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned Callback

The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed, allowing unauthenticated attackers to change the payment status of any order in the store regardless of...

EUVD-2026-114590

The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed, allowing unauthenticated attackers to change the payment status of any order in the store regardless of...

CVE-2026-94361 PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned Callback

The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed, allowing unauthenticated attackers to change the payment status of any order in the store regardless of...

CVE-2026-94361: Unknown Payable Payment Gateway for WooCommerce: The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an…

The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed, allowing unauthenticated attackers to change the payment status of any order in the store regardless of...

PT-2026-134435

Name of the Vulnerable Software and Affected Versions Payable Payment Gateway for WooCommerce WordPress plugin versions prior to 1.3.1 Description The plugin fails to verify the authenticity of incoming payment notifications before updating the status of a WooCommerce order to paid or failed. Thi...

CVE-2026-88928

The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwrite the stored payment token associated with existing orders...

CVE-2026-88928

The PAYCOMET for WooCommerce WordPress plugin (versions 5.36-5.45 ) contains a vulnerability where it fails to verify the cryptographic signature on its payment notification endpoint during tokenisation operations. This flaw allows unauthenticated attackers to overwrite stored payment tokens asso...

CVE-2026-88928 PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification Bypass

The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwrite the stored payment token associated with existing orders...

EUVD-2026-112614

The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwrite the stored payment token associated with existing orders...

CVE-2026-88928 PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification Bypass

The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwrite the stored payment token associated with existing orders...

PT-2026-130661

The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwrite the stored payment token associated with existing orders...

CVE-2026-88928: Unknown PAYCOMET for WooCommerce: The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment…

The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwrite the stored payment token associated with existing orders...

EUVD-2026-111970

The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the verification is keyed on a merchant secret that is empty by default and the rest of the signed data is attacker-controlled, allowing unauthenticated attackers to...

CVE-2026-103312

The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment notifications on a stock install, because the callback's checksum is keyed on a merchant secret that is empty until it is manually configured, allowing an unauthenticated attacker to...