CVE-2026-15246 RealHomes Memberships < 3.1.0 - Subscriber+ Membership Payment Bypass

The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages...

EUVD-2026-53935

The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages...

CVE-2026-15246

Vulnerability summary (CVE-2026-15246). The RealHomes Memberships WordPress plugin prior to version 3.1.0 fails to verify that a membership payment completed, and does not check a nonce or user capability before granting a paid membership package. This allows any authenticated user (e.g., a Subsc...

CVE-2026-15246 RealHomes Memberships < 3.1.0 - Subscriber+ Membership Payment Bypass

The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages...

CVE-2026-16734

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a...

CVE-2026-16734

The Stripe Payment Forms by WP Full Pay WordPress plugin versions before 8.5.2 is vulnerable to unauthenticated payment intent amount manipulation . The root cause is a lack of ownership verification for two specific AJAX actions: pricing-recalculation and payment-intent-update. While an ownershi...

EUVD-2026-53725

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a...

CVE-2026-16734

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a...

CVE-2026-16734 Stripe Payment Forms by WP Full Pay < 8.5.2 - Unauthenticated Payment Intent Amount Manipulation

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a...

EUVD-2026-53719

The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token, allowing unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment...

CVE-2026-10599: Insufficient Verification of Data Authenticity

The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the order being marked as paid, nor does it verify the authenticity of its payment-completion request, allowing unauthenticated attackers to reuse a single valid...

PT-2026-68640

Name of the Vulnerable Software and Affected Versions Payment Gateway for Redsys & WooCommerce Lite WordPress plugin versions prior to 7.0.2 Description The plugin fails to verify the authenticity of incoming payment-provider notifications for a specific payment method before marking orders as...

PT-2026-68499

Name of the Vulnerable Software and Affected Versions RealHomes Memberships WordPress plugin versions prior to 3.1.0 Description An issue exists where the plugin fails to verify if a membership payment was completed and does not validate a nonce a unique token used to prevent cross-site request...

CVE-2026-14842: Authorization Bypass Through User-Controlled Key

The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid...

CVE-2026-16734: Missing Authorization

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a...

PT-2026-68635

Name of the Vulnerable Software and Affected Versions Integrate PhonePe with WooCommerce WordPress plugin versions prior to 1.2.2 Description The plugin fails to validate whether a verified payment transaction is associated with the specific order being marked as paid. Additionally, it does not...

PT-2026-68401

Name of the Vulnerable Software and Affected Versions Stripe Payment Forms by WP Full Pay versions prior to 8.5.2 Description An issue exists where the plugin fails to verify if the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions. This allows an...

CVE-2026-12501: Insufficient Verification of Data Authenticity

The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid, allowing unauthenticated attackers to mark bookin...

CVE-2026-11361: Insufficient Verification of Data Authenticity

The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete, allowing unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership...

CVE-2026-15147: Insufficient Verification of Data Authenticity

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark...