WordPress Plugin Vulnerabilities

UnitechPay <= 1.0.6.3 - Unauthenticated Order Payment Bypass via Unsigned Webhook

Description

The plugin does not verify the authenticity of the payment notifications it receives, allowing unauthenticated attackers to mark orders placed through it as paid without any payment being made, as well as to force other orders into a failed state.

Proof of Concept

Affects Plugins

Plugin icon
unitechpay-paiements-mobile-money
No known fix

References

CVE
CVE-2026-87841

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Timur
Submitter
Timur
Verified
Yes
WPVDB ID
f04babb4-2dee-4c41-8b4c-0c2428009180

Timeline

Publicly Published
2026-10-06 (about 2 days ago)
Added
2026-09-29 (about 9 days ago)
Last Updated
2026-09-29 (about 9 days ago)

Other

Published
Title
Published
2023-12-27
Title
WP Frontend Profile < 1.3.2 - Unauthenticated Privilege Escalation
Published
2023-07-05
Title
BadgeOS <= 3.7.1.6 - Missing Authorization in delete_badgeos_log_entries
Published
2026-04-15
Title
ProfilePress < 4.16.13 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription
Published
2026-02-06
Title
myCred < 2.9.7.4 - Missing Authorization
Published
2024-05-17
Title
Contact Form Plugin by Fluent Forms < 5.1.17 - Unauthenticated Limited Privilege Escalation