CVE-2026-105975

The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parameters, allowing unauthenticated attackers to mark payment records as paid, destroy genuine payment...

CVE-2026-105975

The CamPay Shortcode Payment Gateway WordPress plugin (versions before 1.7 ) is vulnerable to unauthenticated payment status forgery . The root cause is a failure to verify the authenticity of Mobile Money payment confirmations, as the plugin derives results from client-supplied parameters. This ...