CVE-2026-84091: Improper Authentication

The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment...

CVE-2026-87979: Missing Authorization

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts...

CVE-2026-77765: Improper Access Control

The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item...

PT-2026-97162

Name of the Vulnerable Software and Affected Versions The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions prior to 8.9.5 Description A REST collection endpoint is not scoped to the requesting user, which allows users with subscriber-level accounts t...

PT-2026-97163

Name of the Vulnerable Software and Affected Versions Payment Plugins for PayPal WooCommerce WordPress plugin versions prior to 2.0.27 Description The plugin fails to verify if a PayPal order provided in a payment request corresponds to the WooCommerce order being processed, provided the PayPal...

PT-2026-97275

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment...

CVE-2026-93620: Missing Authorization

Unauthenticated Broken Access Control in PayPlus Payment Gateway = 8.2.5 versions...

CVE-2026-18872: Improper Neutralization of Input During Web Page Generation

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to stored cross-site scripting CWE-79 in the FTM UI NetworkAcknowledgement React component NetworkAcknowledgement.jsx:42. A malicious actor can inject script into stored network acknowledgement data that executes in...

CVE-2026-87978: Insufficient Verification of Data Authenticity

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment...

CVE-2026-87981: Missing Authorization

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment...

CVE-2026-87069: Missing Authorization

The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any...

PT-2026-97187

Name of the Vulnerable Software and Affected Versions Paymob for WooCommerce WordPress plugin versions prior to 4.1.14 Description Insufficient capability checks on several admin AJAX actions used to manage payment-gateway configuration allow users with contributor-level access to delete, wipe, o...

PT-2026-97356

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description The FTM AI agent server is susceptible to RAG poisoning, a technique where malicious data is injected into a Retrieval-Augmented Generation...

PT-2026-97448

Name of the Vulnerable Software and Affected Versions PayPlus Payment Gateway versions prior to 8.2.6 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 8.2.5...

CVE-2026-18132

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to perform unauthorized payment mutation actions due to missing authorization...

CVE-2026-18132 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to perform unauthorized payment mutation actions due to missing authorization...

CVE-2026-18132

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by a vulnerability that allows a remote authenticated attacker to perform unauthorized payment mutation actions . This flaw is caused by missing authorization checks within the system. The provided documents do not specify t...

CVE-2026-18132 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to perform unauthorized payment mutation actions due to missing authorization...

CVE-2026-89420

Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged. MPP.Session.Actions.acceptvoucher/3 in lib/mpp/session/actions.ex treats a voucher whose cumulativeAmount equals the channel's...

CVE-2025-14487

The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings, including publishable...