CVE-2026-16650 Charitable < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass

The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment...

CVE-2026-15150 myCred < 3.2.5 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification in buyCRED

The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a...

CVE-2026-15150

The myCred WordPress plugin before 3.2.5 contains an unauthenticated payment bypass in the buyCRED function. The plugin fails to verify that the receiver of an incoming payment gateway notification (e.g., PayPal IPN) matches the site's configured merchant account. An unauthenticated attacker can ...

EUVD-2026-63909

The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a...

CVE-2026-15150 myCred < 3.2.5 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification in buyCRED

The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a...

WordPress TrueBooker Appointment Booking plugin < 1.2.7 - Unauthenticated Appointment and Payment Record Deletion via update_appointment_booked vulnerability

Unauthenticated Appointment and Payment Record Deletion via updateappointmentbooked vulnerability discovered by Erwan LR WPScan in WordPress Plugin TrueBooker versions 1.2.7...

WordPress TabaPay Gateway plugin <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback vulnerability

Unauthenticated Account Takeover via Payment Callback vulnerability discovered by moonge in WordPress Plugin TabaPay Gateway versions = 1.4.0...

CVE-2026-16577

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a reverse-withdrawal payment, allowing a vendor to credit their reverse-withdrawal...

EUVD-2026-63819

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a reverse-withdrawal payment, allowing a vendor to credit their reverse-withdrawal...

CVE-2026-16650: Insufficient Verification of Data Authenticity

The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment...

CVE-2026-15150: Insufficient Verification of Data Authenticity

The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a...

PT-2026-79368

The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a...

PT-2026-79369

The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment...

Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments

Researchers at the University of Massachusetts Amherst have demonstrated an attack that revives expired Visa contactless credit cards for real in-store purchases by rewriting the expiration date a point-of-sale POS terminal reads over near-field communication NFC, without breaking any of the card...

WordPress WP Events Manager plugin < 2.2.5 - Subscriber+ Payment Bypass via 'qty' Parameter vulnerability

Subscriber+ Payment Bypass via 'qty' Parameter vulnerability discovered by Mustafa Ahmed in WordPress Plugin WP Events Manager versions 2.2.5...

WordPress Payment Plugins for PayPal WooCommerce plugin < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order vulnerability

Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order vulnerability discovered by Shivamani Vastrala in WordPress Plugin Payment Plugins for PayPal WooCommerce versions 2.0.20...

WordPress WC Buckaroo BPE Gateway plugin < 4.9.0 - Subscriber+ Unauthorized Order Refund vulnerability

Subscriber+ Unauthorized Order Refund vulnerability discovered by Vaibhav Narkhede in WordPress Plugin Buckaroo Woocommerce Payments Plugin versions 4.9.0...

WordPress GetPaid plugin < 2.8.55 - Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verification vulnerability

Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verification vulnerability discovered by Pedro Pinho in WordPress Plugin GetPaid versions 2.8.55...

WordPress Payment Gateway for Redsys & WooCommerce Lite plugin < 7.0.2 - Unauthenticated Payment Confirmation via Unverified Inespay Callback vulnerability

Unauthenticated Payment Confirmation via Unverified Inespay Callback vulnerability discovered by Shivamani Vastrala in WordPress Plugin Redsys for WooCommerce Light versions 7.0.2...

WordPress WP Travel Engine plugin < 6.8.2 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver and Amount Verification vulnerability

Unauthenticated Payment Bypass via Missing PayPal IPN Receiver and Amount Verification vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Travel Engine versions 6.8.2...