EUVD-2026-67734

Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...

CVE-2026-81767

CVE-2026-81767 affects the WordPress Simple Payment plugin in versions 2.5.2 and earlier , presenting an unauthenticated Broken Access Control flaw. The CVSS 3.1 base score is 7.5 (HIGH) , with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, indicating an attacker requires no credentials or user...

CVE-2026-81767 WordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...

CVE-2026-81767 WordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...

WordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by JunHee CHO in WordPress Plugin Simple Payment versions = 2.5.2...

CVE-2026-81767: Missing Authorization

Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...

CVE-2026-18324: Improper Neutralization of Input During Web Page Generation

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible...

PT-2026-83153

Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...

PCI DSS 4.0.1: Application Requirements You’re Being Assessed On in 2026

Key Takeaways Since March 31, 2025, all 51 former “best practice” requirements in PCI DSS 4.0 have been fully scored. Every 2026 assessment covers them. A large share of the new weight sits in the PCI DSS 4.0.1 application requirements , concentrated in Requirements 6 and 11: inventory of custom...

WordPress Restore PayPal Standard for WooCommerce plugin < 3.1.1 - Payment Bypass via Unvalidated receiver_email vulnerability

Payment Bypass via Unvalidated receiveremail vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Accept PayPal & Stripe with Subscriptions for WooCommerce versions 3.1.1...

CVE-2026-78125

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

CVE-2026-78125 LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

CVE-2026-78125

The LearnPress WordPress plugin (specifically the Sepay Payment component) is vulnerable in versions up to and including 4.0.2 due to a missing authorization check on one of its REST endpoints . This flaw allows unauthenticated attackers to disclose the payment status of arbitrary orders by enume...

WordPress LearnPress plugin < 4.0.3 - Unauthenticated Order Status Disclosure vulnerability

Unauthenticated Order Status Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin LearnPress & Sepay Payment versions 4.0.3...

CVE-2026-78125 LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

EUVD-2026-66881

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

CVE-2026-78125: Exposure of Sensitive Information to an Unauthorized Actor

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

PT-2026-82427

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

DRUPAL-CONTRIB-2026-106

This module integrates Drupal Commerce with the CyberSource payment gateway. The module does not correctly verify the integrity of data returned by the payment provider. A timing attack could allow an attacker to trick the site into registering that payment has been received even if it hasn't. Th...

CVE-2026-77694

The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken...