EUVD-2026-109734

Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5...

EUVD-2026-109735

Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5...

EUVD-2026-109712

Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through 1.2.3...

CVE-2026-115959

The APIExperts Square for WooCommerce plugin for WordPress (versions up to and including 4.7.5 ) is vulnerable to a Broken Access Control issue. The root cause is a Missing Authorization vulnerability where the software fails to properly enforce security levels, allowing attackers to exploit inco...

CVE-2026-115960

The APIExperts Square for WooCommerce plugin (versions n/a through 4.7.5 ) is vulnerable to a Broken Access Control issue caused by Missing Authorization (CWE-862). The vulnerability allows an attacker to exploit incorrectly configured access control security levels within the woosquare component...

CVE-2026-110377

Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through 1.2.3...

CVE-2026-110377

The VillaTheme Bopo – WooCommerce Product Bundle Builder plugin (bopo-woo-product-bundle-builder) is vulnerable to a Missing Authorization vulnerability affecting versions n/a through 1.2.3 . This flaw allows for the exploitation of Incorrectly Configured Access Control Security Levels . The vuln...

CVE-2026-110377 WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through 1.2.3...

WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mash in WordPress Plugin Bopo – WooCommerce Product Bundle Builder versions = 1.2.3...

WordPress Mintpay for WooCommerce plugin <= 2.2.3 - Unauthenticated Order Payment Completion and Cancellation vulnerability

Unauthenticated Order Payment Completion and Cancellation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Mintpay for WooCommerce versions = 2.2.3...

WordPress Eurobank WooCommerce Payment Gateway plugin <= 2.1.1 - Unauthenticated Order Payment Forgery vulnerability

Unauthenticated Order Payment Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Eurobank WooCommerce Payment Gateway versions = 2.1.1...

WordPress CCAvenue Payment Gateway for WooCommerce plugin <= 3.1 - Unauthenticated Order Payment Completion vulnerability

Unauthenticated Order Payment Completion vulnerability discovered by Naoki Kawahigashi in WordPress Plugin CCAvenue Payment Gateway for WooCommerce versions = 3.1...

CVE-2026-103319

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and...

CVE-2026-103381

The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes, allowing unauthenticated attackers to mark arbitrary orders as paid, to cancel arbitrary orders, and to disclose order details including customer contact information...

CVE-2026-103300

The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending...

CVE-2026-103298

The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install, allowing unauthenticated attackers to for...

CVE-2026-103300 Eurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery via Unverified Callback

The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending...

CVE-2026-103300

The Eurobank WooCommerce Payment Gateway WordPress plugin (versions up to and including 2.1.1 ) is vulnerable to an unauthenticated order payment forgery . The root cause is the failure to verify that payment-confirmation requests originate from the legitimate payment provider, compounded by a de...

EUVD-2026-109635

The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending...

CVE-2026-103299 nexi Alpha Bank for WooCommerce <= 2.2.0 - Unauthenticated Payment Confirmation Forgery via Empty Shared Secret

The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the...