CVE-2026-96173 — Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR

CVE-2026-96173

Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR PUBLISHED

Description (CNA)

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents.

Affected (CNA)

Vendor / product	Versions
Unknown / Payments for Hubtel	affected 0 before 1.0.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/fcaa1526-0cf4-4356-9cf8-bc2dc3ed33b8/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.