WordPress Plugin Vulnerabilities

Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forgery via Unverified Signature

Description

The plugin does not verify that a payment notification actually originated from the payment provider before marking the associated order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made.

Proof of Concept

Affects Plugins

Plugin icon
chikkili-google-pay-for-woocommerce
No known fix

References

CVE
CVE-2026-94295

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Pedro Pinho
Submitter
Pedro Pinho
Verified
Yes
WPVDB ID
d6ee17a1-0db1-4610-8c96-96e98fb734ec

Timeline

Publicly Published
2026-10-22 (about 2 days ago)
Added
2026-10-15 (about 9 days ago)
Last Updated
2026-10-15 (about 9 days ago)

Other

Published
Title
Published
2026-08-05
Title
Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder < 2.0.0 - Missing Authorization
Published
2026-10-16
Title
AI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_media
Published
2023-10-16
Title
ApplyOnline < 2.5.4 - Missing Authorization
Published
2025-12-04
Title
EPROLO Dropshipping < 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Tracking Data Modification
Published
2026-06-26
Title
Spexo < 2.0.12 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation