CVE-2026-80311: Authorization Bypass Through User-Controlled Key

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other...

CVE-2026-18234: Missing Authorization

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid...

PT-2026-83399

Name of the Vulnerable Software and Affected Versions MStore API versions prior to 4.21.1 Description The MStore API WordPress plugin fails to verify if the order targeted by a delivery endpoint belongs to the user making the request. This allows any authenticated user, including those with...

PT-2026-83400

Name of the Vulnerable Software and Affected Versions MStore API versions prior to 4.21.1 Description The MStore API WordPress plugin fails to verify if the order targeted by its wallet payment handling belongs to the requester. Additionally, it does not deduct the wallet balance for most payment...

CVE-2026-82423: Improper Enforcement of Behavioral Workflow

A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of the component Payment Status Endpoint. The manipulation of the argument orderId leads to enforcement of behavioral workflow. The attack is possible to be...

PT-2026-83414

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.40 Description An issue exists where the plugin fails to verify the amount, receiver, currency, or status of a payment notification before marking an order as completed. This allows...

CVE-2026-81767

Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...

EUVD-2026-67734

Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...

CVE-2026-81767

CVE-2026-81767 affects the WordPress Simple Payment plugin in versions 2.5.2 and earlier , presenting an unauthenticated Broken Access Control flaw. The CVSS 3.1 base score is 7.5 (HIGH) , with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, indicating an attacker requires no credentials or user...

CVE-2026-81767 WordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...

CVE-2026-81767 WordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...

WordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by JunHee CHO in WordPress Plugin Simple Payment versions = 2.5.2...

CVE-2026-81767: Missing Authorization

Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...

CVE-2026-18324: Improper Neutralization of Input During Web Page Generation

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible...

PT-2026-83153

Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...

PCI DSS 4.0.1: Application Requirements You’re Being Assessed On in 2026

Key Takeaways Since March 31, 2025, all 51 former “best practice” requirements in PCI DSS 4.0 have been fully scored. Every 2026 assessment covers them. A large share of the new weight sits in the PCI DSS 4.0.1 application requirements , concentrated in Requirements 6 and 11: inventory of custom...

WordPress Restore PayPal Standard for WooCommerce plugin < 3.1.1 - Payment Bypass via Unvalidated receiver_email vulnerability

Payment Bypass via Unvalidated receiveremail vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Accept PayPal & Stripe with Subscriptions for WooCommerce versions 3.1.1...

CVE-2026-78125

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

CVE-2026-78125 LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

CVE-2026-78125

The LearnPress WordPress plugin (specifically the Sepay Payment component) is vulnerable in versions up to and including 4.0.2 due to a missing authorization check on one of its REST endpoints . This flaw allows unauthenticated attackers to disclose the payment status of arbitrary orders by enume...