CVE-2026-94360 — Paymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card Callbacks

CVE-2026-94360

Paymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card Callbacks PUBLISHED

Description (CNA)

The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as paid, allowing unauthenticated attackers to mark orders as paid without any payment being completed.

Affected (CNA)

Vendor / product	Versions
Unknown / Paymentfor Gateway for WooCommerce	affected 0 before 1.0.6

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/f9ef7bfe-3e25-4edf-9c02-3fa9e2873e84/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.