WordPress Plugin Vulnerabilities

PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned Callback

Description

The plugin does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed, allowing unauthenticated attackers to change the payment status of any order in the store regardless of the payment method it was placed with.

Proof of Concept

Affects Plugins

Plugin icon
payable-payment-gateway-for-woocommerce
Fixed in 1.3.1

References

CVE
CVE-2026-94361

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Enrico Marcolini, Claudio Marchesini, Dottor Marc
Submitter
Enrico Marcolini, Claudio Marchesini, Dottor Marc
Submitter website
https://www.dottormarc.it
Verified
Yes
WPVDB ID
1c6a831e-2d14-4c73-8a9e-d28d9262f626

Timeline

Publicly Published
2026-10-29 (about 2 days ago)
Added
2026-10-29 (about 1 day ago)
Last Updated
2026-10-29 (about 1 day ago)

Other

Published
Title
Published
2026-05-06
Title
Forminator < 1.53.0.1 - Subscriber+ Scheduled Form Submissions Export
Published
2025-04-04
Title
Privyr CRM <= 1.0.2 - Missing Authorization
Published
2026-08-15
Title
Solace Extra < 1.6.1 - Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Action
Published
2025-12-18
Title
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program < 2.9.7.2 - Missing Authorization to Sensitive Information Exposure
Published
2025-04-04
Title
Variable Inspector <= 2.6.3 - Missing Authorization