EUVD-2026-75513

Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce = 1.8.9 versions...

CVE-2026-78536 WordPress Robokassa payment gateway for Woocommerce plugin <= 1.8.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce = 1.8.9 versions...

WordPress WP Express Checkout plugin < 2.5.0 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by ryan zegar in WordPress Plugin WP Express Checkout Accept PayPal Payments versions 2.5.0...

WordPress Payment Plugins for PayPal WooCommerce plugin < 2.0.26 - Subscriber+ Stored Payment Method Assignment vulnerability

Subscriber+ Stored Payment Method Assignment vulnerability discovered by m1w34p0n & krypt3d in WordPress Plugin Payment Plugins for PayPal WooCommerce versions 2.0.26...

PT-2026-89427

Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce = 1.8.9 versions...

CVE-2026-78536: Missing Authorization

Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce = 1.8.9 versions...

WordPress Robokassa payment gateway for Woocommerce plugin <= 1.8.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by HaiND in WordPress Plugin Robokassa payment gateway for Woocommerce versions = 1.8.9...

CVE-2026-15398

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.22. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-15398 Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.22. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-15398

The Eventin WordPress plugin (Event Calendar, Event Registration, Tickets & Booking, AI Powered) is vulnerable to an authorization bypass in all versions up to and including 4.1.22 . The root cause is improper authorization verification in the OrderController , where the wp_rest nonce is publicly...

EUVD-2026-74760

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.22. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-83537

The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...

CVE-2026-83537 WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment

The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...

CVE-2026-83537

The WP Express Checkout WordPress plugin before 2.5.0 is vulnerable to an unauthenticated payment bypass via the wpec_process_empty_payment function. The root cause is the absence of server-side verification that a payment was actually completed before marking an order as paid, allowing unauthent...

EUVD-2026-74723

The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...

CVE-2026-83537 WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment

The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...

CVE-2026-80341

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer's stored card to their own account and then charge or delete it...

CVE-2026-18042

The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking...

CVE-2026-13146

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a...

CVE-2026-80341 Payment Plugins for PayPal WooCommerce < 2.0.26 - Subscriber+ Stored Payment Method Assignment via IDOR

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer's stored card to their own account and then charge or delete it...