WordPress UnitechPay plugin <= 1.0.6.3 - Unauthenticated Order Payment Bypass vulnerability

Unauthenticated Order Payment Bypass vulnerability discovered by Timur in WordPress Plugin UnitechPay versions = 1.0.6.3...

CVE-2026-87841

The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receives, allowing unauthenticated attackers to mark orders placed through it as paid without any payment being made, as well as to force other orders into a failed state...

EUVD-2026-95505

The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receives, allowing unauthenticated attackers to mark orders placed through it as paid without any payment being made, as well as to force other orders into a failed state...

CVE-2026-87841

The UnitechPay WordPress plugin (versions through 1.0.6.3 ) is vulnerable to an unauthenticated order payment bypass due to a lack of verification for the authenticity of received payment notifications. This allows unauthenticated attackers to exploit unsigned webhooks to mark orders as paid with...

CVE-2026-87841 UnitechPay <= 1.0.6.3 - Unauthenticated Order Payment Bypass via Unsigned Webhook

The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receives, allowing unauthenticated attackers to mark orders placed through it as paid without any payment being made, as well as to force other orders into a failed state...

PT-2026-108744

Name of the Vulnerable Software and Affected Versions UnitechPay WordPress plugin versions prior to 1.0.6.4 Description The plugin fails to verify the authenticity of received payment notifications. This allows unauthenticated attackers to manipulate order statuses, such as marking orders as paid...

CVE-2026-87841: Missing Authorization

The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receives, allowing unauthenticated attackers to mark orders placed through it as paid without any payment being made, as well as to force other orders into a failed state...

CVE-2026-39650

Missing Authorization vulnerability in Unitech Web UnitechPay unitechpay-paiements-mobile-money allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UnitechPay: from n/a through = 1.0.2...

EUVD-2026-20316

Missing Authorization vulnerability in Unitech Web UnitechPay unitechpay-paiements-mobile-money allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UnitechPay: from n/a through = 1.0.2...

CVE-2026-39650

Missing Authorization vulnerability in Unitech Web UnitechPay unitechpay-paiements-mobile-money allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UnitechPay: from n/a through = 1.0.2...

CVE-2026-39650 WordPress UnitechPay plugin <= 1.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Unitech Web UnitechPay unitechpay-paiements-mobile-money allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UnitechPay: from n/a through = 1.0.2...

CVE-2026-39650

Missing Authorization vulnerability in Unitech Web UnitechPay unitechpay-paiements-mobile-money allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UnitechPay: from n/a through = 1.0.2...

CVE-2026-39650 WordPress UnitechPay plugin <= 1.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Unitech Web UnitechPay unitechpay-paiements-mobile-money allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UnitechPay: from n/a through = 1.0.2...

CVE-2026-39650

CVE-2026-39650 affects the WordPress UnitechPay plugin (unitechpay-paiements-mobile-money) and is described as a Missing Authorization / Broken Access Control vulnerability due to incorrectly configured access control. The issue is stated to affect UnitechPay versions from n/a up to and including...

WordPress plugin UnitechPay 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

PT-2026-31214

Missing Authorization vulnerability in Unitech Web UnitechPay unitechpay-paiements-mobile-money allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UnitechPay: from n/a through = 1.0.2...

CVE-2026-39650: Missing Authorization

Missing Authorization vulnerability in Unitech Web UnitechPay unitechpay-paiements-mobile-money allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UnitechPay: from n/a through = 1.0.2...