WordPress Plugin Vulnerabilities

ePayco Payment Gateway for WooCommerce < 8.4.7 - Unauthenticated Payment Confirmation Bypass

Description

The plugin does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signature.

Proof of Concept

Affects Plugins

Plugin icon
epayco-gateway
Fixed in 8.4.7

References

CVE
CVE-2026-84043

Miscellaneous

Original Researcher
Pedro Pinho
Submitter
Pedro Pinho
Verified
Yes
WPVDB ID
96599654-1d7f-4ff0-a4b4-26e540375a67

Timeline

Publicly Published
2026-09-02 (about 2 days ago)
Added
2026-09-02 (about 1 day ago)
Last Updated
2026-09-02 (about 1 day ago)

Other

Published
Title
Published
2024-01-17
Title
Getwid – Gutenberg Blocks < 2.0.5 - Captcha Bypass
Published
2017-05-16
Title
WordPress 3.4.0-4.7.4 - XML-RPC Post Meta Data Lack of Capability Checks
Published
2026-08-03
Title
WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR
Published
2018-11-12
Title
Social Sharing Plugin - Kiwi < 2.0.11 - Arbitrary WordPress Options Update
Published
2022-11-29
Title
Appointment Hour Booking < 1.3.73 - CAPTCHA Bypass