PT-2026-97187

Name of the Vulnerable Software and Affected Versions Paymob for WooCommerce WordPress plugin versions prior to 4.1.14 Description Insufficient capability checks on several admin AJAX actions used to manage payment-gateway configuration allow users with contributor-level access to delete, wipe, o...

CVE-2026-87978: Insufficient Verification of Data Authenticity

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment...

CVE-2026-87069: Missing Authorization

The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any...

PT-2026-97275

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment...

PT-2026-97448

Name of the Vulnerable Software and Affected Versions PayPlus Payment Gateway versions prior to 8.2.6 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 8.2.5...

CVE-2026-87981: Missing Authorization

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment...

CVE-2026-18132

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to perform unauthorized payment mutation actions due to missing authorization...

CVE-2026-18132 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to perform unauthorized payment mutation actions due to missing authorization...

CVE-2026-18132

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by a vulnerability that allows a remote authenticated attacker to perform unauthorized payment mutation actions . This flaw is caused by missing authorization checks within the system. The provided documents do not specify t...

CVE-2026-18132 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to perform unauthorized payment mutation actions due to missing authorization...

CVE-2026-89420

Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged. MPP.Session.Actions.acceptvoucher/3 in lib/mpp/session/actions.ex treats a voucher whose cumulativeAmount equals the channel's...

CVE-2025-14487

The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings, including publishable...

CVE-2025-14487 Handily <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification via 'stripe_publishbale_key' Parameter

The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings, including publishable...

CVE-2025-14487 Handily <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification via 'stripe_publishbale_key' Parameter

The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings, including publishable...

CVE-2025-14487

The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification in all versions up to and including 1.0.3 . The root cause is missing authorization checks within the payment settings parameters, allowing unauthenticated attackers to modify Stripe configuration setting...

PT-2026-97089

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Missing authorization in the software allows a remote authenticated attacker to perform unauthorized payment mutation actions. Recommendatio...

PT-2026-96658

Name of the Vulnerable Software and Affected Versions Handily plugin for WordPress versions prior to 1.0.4 Description Missing authorization checks allow unauthenticated attackers to modify Stripe payment configuration settings. By manipulating payment settings parameters, an attacker can change...

CVE-2026-18132: Missing Authorization

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to perform unauthorized payment mutation actions due to missing authorization...

CVE-2025-14487: Missing Authorization

The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings, including publishable...

CVE-2026-92400

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated user...