WordPress Plugin Vulnerabilities
PayDunya WooCommerce Payment Gateway 1.1.6 - Unauthenticated Order Payment Completion via Webhook Forgery
Description
The plugin does not verify the authenticity of incoming payment notifications and, until the gateway is configured, authenticates them with a value derived from an empty secret that anyone can compute, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid and completed.
Proof of Concept
Affects Plugins
No known fix References
CVE
Classification
Type
AUTHBYPASS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Naoki Kawahigashi
Submitter
Naoki Kawahigashi
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-10-24 (about 2 days ago)
Added
2026-10-17 (about 9 days ago)
Last Updated
2026-10-17 (about 9 days ago)
