PT-2026-68650

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark...

PT-2026-68639

Name of the Vulnerable Software and Affected Versions WP Travel Engine versions prior to 6.8.2 Description The plugin fails to verify if incoming PayPal payment notifications were sent to the configured merchant account or if the paid amount matches the order total before marking a booking as pai...

PT-2026-68636

Name of the Vulnerable Software and Affected Versions Formidable Forms WordPress plugin versions prior to 6.32.1 Description Insufficient validation of PayPal subscription payment status allows unauthenticated users to bypass payment processes. This enables the triggering of paid form actions,...

PT-2026-68635

Name of the Vulnerable Software and Affected Versions Integrate PhonePe with WooCommerce WordPress plugin versions prior to 1.2.2 Description The plugin fails to validate whether a verified payment transaction is associated with the specific order being marked as paid. Additionally, it does not...

PT-2026-68648

Name of the Vulnerable Software and Affected Versions Events Made Easy WordPress plugin versions prior to 3.1.2 Description An issue exists where the payment authorization token is not bound to the specific payment record being charged. This allows unauthenticated attackers to complete a payment...

PT-2026-68652

Name of the Vulnerable Software and Affected Versions WP Hotel Booking WordPress plugin versions prior to 2.3.2 Description An issue exists where the plugin fails to verify if a payment notification is linked to the site's own merchant account or if the paid amount aligns with the booking total...

CVE-2026-12901: Insufficient Verification of Data Authenticity

The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made...

CVE-2026-19127: Insufficient Verification of Data Authenticity

An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting insufficient cryptographic validation or lack of server-side state verification on promotional/lifetime-deal LTD redemption codes, an unauthenticated attacker...

PT-2026-68681

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A flaw in the billing and license activation subsystem enables remote, unauthenticated attackers to bypass payment authorization workflows. The issue stems from...

Malicious code in dolyame-boxy-mobile-bnpl-card-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81f9a7ce9653fe40c88e75d2eebba37ae255fd0eb7e71cd9e962d34db491a218 On require, bootstrap.js downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints oob-worker.cf103-070.workers.dev,...

MAL-2026-12801 Malicious code in sc-payment-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78b75d6f50386e1c630638fb334a8de08ad5fd2e1b7811ce63e2c6a64d7e3a09 [email protected] declares a preinstall script that executes callback.js on npm install. The script collects host identity os.hostname,...

CVE-2026-55739

Crater isolates data per companyid, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and -hasCompany-companyid. CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound custome...

PT-2026-68033

Name of the Vulnerable Software and Affected Versions WPFormify – Stripe Payments with Form and Checkout versions prior to 1.1.2 Description Unauthenticated attackers can modify or delete Stripe payment credentials. This occurs because the wpf stripe callback success and wpf stripe disconnect...

EUVD-2026-42658

Ghost: Paid gift memberships obtainable at minimal cost via the donations feature...

Authorization Bypass Through User-Controlled Key

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the customerId parameter in the GET /api/v1/organization/customer-default-source endpoint. An attacker can access sensitive payment and profile informati...

GHSA-2364-JH4Q-M9VM Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint

Summary An Insecure Direct Object Reference IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint. This flaw allows an authenticated attacker to bypass authorization checks and retrieve sensitive payment and profile information of other customers by manipulati...

WordPress Eventin plugin < 4.1.16 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Haitam Lazaar in WordPress Plugin WP Event SOlution versions 4.1.16...

WordPress WP Travel plugin < 11.8.1 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin WP Travel versions 11.8.1...

WordPress GiveWP plugin < 4.16.3 - Unauthenticated Payment Gateway Restriction Bypass vulnerability

Unauthenticated Payment Gateway Restriction Bypass vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin GiveWP versions 4.16.3...

WordPress FlxWoo plugin < 3.1.1 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin FlxWoo versions 3.1.1...