PT-2026-94187

Name of the Vulnerable Software and Affected Versions Robokassa payment gateway for Woocommerce WordPress plugin versions prior to 1.8.9 Description The plugin fails to verify the authenticity of incoming payment notifications when the non-default deferred-payment feature is enabled. This allows...

PT-2026-95143

Name of the Vulnerable Software and Affected Versions MythicalDash versions prior to 3.5.4-aurora Description An unauthenticated payment bypass exists in the Stripe success-redirect mechanism. The endpoint '/api/stripe/process' creates a pending payment record before checkout is completed and...

PT-2026-94173

Name of the Vulnerable Software and Affected Versions Paid Membership Subscriptions versions prior to 3.0.9 Description An issue exists where the plugin fails to verify if the amount and currency reported by the payment provider match the pending payment before completion. This allows...

WordPress Eventin plugin < 4.1.24 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by cyberkareem in WordPress Plugin WP Event Solution versions 4.1.24...

CVE-2026-88255

Improper Validation of Unsafe Equivalence in Input in ZenHive mpp allows an unauthenticated remote client to pass the Tempo duplicate-submission gate twice with one signed transaction. MPP.Methods.Tempo reserves the pre-broadcast dedup slot on the caller-supplied hex in reservehashatomic/2, keyed...

CVE-2026-89186

Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP.Plug.verifycredential in lib/mpp/plug.ex sets payment-receipt and cache-control: private on the connection before the wrapped application...

CVE-2026-88255 mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slot

Improper Validation of Unsafe Equivalence in Input in ZenHive mpp allows an unauthenticated remote client to pass the Tempo duplicate-submission gate twice with one signed transaction. MPP.Methods.Tempo reserves the pre-broadcast dedup slot on the caller-supplied hex in reservehashatomic/2, keyed...

CVE-2026-88255

CVE-2026-88255 is an improper validation of unsafe equivalence in input in ZenHive mpp (versions 0.2.0 through before 0.16.2). The root cause lies in MPP.Methods.Tempo, where the pre-broadcast dedup reserve (reserve_hash_atomic/2) keys on the caller-supplied raw hex (tx.raw) rather than a canonic...

EUVD-2026-80256

Improper Validation of Unsafe Equivalence in Input in ZenHive mpp allows an unauthenticated remote client to pass the Tempo duplicate-submission gate twice with one signed transaction. MPP.Methods.Tempo reserves the pre-broadcast dedup slot on the caller-supplied hex in reservehashatomic/2, keyed...

EEF-CVE-2026-88255 mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slot

Summary Improper Validation of Unsafe Equivalence in Input in ZenHive mpp allows an unauthenticated remote client to pass the Tempo duplicate-submission gate twice with one signed transaction. MPP.Methods.Tempo reserves the pre-broadcast dedup slot on the caller-supplied hex in reservehashatomic/...

CVE-2026-89186 mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches

Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP.Plug.verifycredential in lib/mpp/plug.ex sets payment-receipt and cache-control: private on the connection before the wrapped application...

EUVD-2026-80254

Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP.Plug.verifycredential in lib/mpp/plug.ex sets payment-receipt and cache-control: private on the connection before the wrapped application...

CVE-2026-89186 mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches

Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP.Plug.verifycredential in lib/mpp/plug.ex sets payment-receipt and cache-control: private on the connection before the wrapped application...

EEF-CVE-2026-89186 mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches

Summary Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP.Plug.verifycredential in lib/mpp/plug.ex sets payment-receipt and cache-control: private on the connection before the wrapped...

CVE-2026-84906

The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway reports the transaction as successful, not its amount, currency, or which order it belongs to, allowing unauthenticated visitors ...

CVE-2026-84906 Eventin < 4.1.24 - Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transaction Replay

The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway reports the transaction as successful, not its amount, currency, or which order it belongs to, allowing unauthenticated visitors ...

CVE-2026-84906 Eventin < 4.1.24 - Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transaction Replay

The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway reports the transaction as successful, not its amount, currency, or which order it belongs to, allowing unauthenticated visitors ...

CVE-2026-84906

Eventin WordPress plugin versions before 4.1.24 contain an unauthenticated payment bypass affecting its Stripe and PayPal integrations. The plugin fails to verify that a completed payment corresponds to the specific order it is applied to, checking only that the gateway reports the transaction as...

EUVD-2026-80219

The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway reports the transaction as successful, not its amount, currency, or which order it belongs to, allowing unauthenticated visitors ...

CVE-2026-84907 Eventin < 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST Endpoint

The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline local payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the caller owns the order, allowing unauthenticated attackers to reset...