WordPress Plugin Vulnerabilities

Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Payment Callback

Description

The plugin does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment.

Proof of Concept

Affects Plugins

Plugin icon
payments-hubtel
Fixed in 1.0.2

References

CVE
CVE-2026-96200

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Enrico Marcolini - Claudio Marchesini - Dottor Marc
Submitter
Enrico Marcolini - Claudio Marchesini - Dottor Marc
Submitter website
https://www.dottormarc.it
Verified
Yes
WPVDB ID
c3ccbe90-6942-46d6-b79b-f3223121eec6

Timeline

Publicly Published
2026-09-29 (about 2 days ago)
Added
2026-09-29 (about 1 day ago)
Last Updated
2026-09-29 (about 1 day ago)

Other

Published
Title
Published
2025-10-15
Title
Felan Framework < 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation/Deactivation via process_plugin_actions
Published
2026-01-03
Title
Don Peppe <= 1.3 - Missing Authorization
Published
2026-06-25
Title
SEOPress PRO < 9.2 - Missing Authorization
Published
2025-04-01
Title
AtomChat <= 1.1.6 - Missing Authorization
Published
2025-12-20
Title
Frontend Post Submission Manager Lite < 1.2.6 - Missing Authorization to Unauthenticated Arbitrary Post Modification