WordPress Plugin Vulnerabilities

elegro Crypto Payment <= 1.0.1 - Unauthenticated Arbitrary Order Status Change via IPN Callback

Description

The plugin does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where that secret has been left at its default empty value.

Proof of Concept

Affects Plugins

Plugin icon
elegro-payment
No known fix

References

CVE
CVE-2026-94299

Classification

Type
INCORRECT AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-863
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
JunHee CHO
Submitter
JunHee CHO
Verified
Yes
WPVDB ID
7eb85c65-8dab-46e1-b1df-e5d966029b18

Timeline

Publicly Published
2026-10-03 (about 2 days ago)
Added
2026-09-26 (about 9 days ago)
Last Updated
2026-09-26 (about 9 days ago)

Other

Published
Title
Published
2024-04-25
Title
WP Time Slots Booking Form < 1.2.07 - Unauthenticated Price Manipulation
Published
2025-10-24
Title
ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution < 4.8.5 - Incorrect Authorization to Authenticated (Editor+) License Status Update
Published
2024-01-12
Title
Spiffy Calendar < 4.9.9 - Broken Access Control
Published
2026-02-18
Title
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce < 6.4.8 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type'
Published
2025-05-05
Title
Reales WP STPT <= 2.1.2 - Unauthorized User Registration