CVE-2026-96200 — Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Payment Callback

CVE-2026-96200

Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Payment Callback PUBLISHED

Description (CNA)

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment.

Affected (CNA)

Vendor / product	Versions
Unknown / Payments for Hubtel	affected 0 before 1.0.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/c3ccbe90-6942-46d6-b79b-f3223121eec6/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.