WordPress Plugin Vulnerabilities

SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via Redirect Callback

Description

The plugin does not bind the payment it confirms with the provider to the order being completed, nor check the payment amount against the order total, allowing unauthenticated users to mark a pending order as paid by replaying a payment identifier obtained from any single genuine payment.

Proof of Concept

Affects Plugins

Plugin icon
woo-payment-gateway-officeguy
Fixed in 4.0.0

References

CVE
CVE-2026-111957

Classification

Type
INCORRECT AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-863
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Enrico Marcolini, Claudio Marchesini, Dottor Marc
Submitter
Enrico Marcolini, Claudio Marchesini, Dottor Marc
Submitter website
https://www.dottormarc.it
Verified
Yes
WPVDB ID
751aa9b8-761e-4982-8708-6a746fddef09

Timeline

Publicly Published
2026-10-19 (about 2 days ago)
Added
2026-10-19 (about 1 day ago)
Last Updated
2026-10-19 (about 1 day ago)

Other

Published
Title
Published
2026-07-22
Title
Simply Schedule Appointments < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint
Published
2023-10-26
Title
WP Hotel Booking < 2.0.9 - Contributor+ Arbitrary Post Deletion
Published
2026-09-21
Title
The Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes
Published
2026-01-09
Title
Blog2Social: Social Media Auto Post & Scheduler < 8.7.3 - Incorrect Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
Published
2026-07-28
Title
Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation via Admin Account Creation