WordPress Plugin Vulnerabilities

Paymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card Callbacks

Description

The plugin does not verify the authenticity of an inbound payment notification before marking an order as paid, allowing unauthenticated attackers to mark orders as paid without any payment being completed.

Proof of Concept

Affects Plugins

Plugin icon
paymentfor-gateway-for-woocommerce
Fixed in 1.0.6

References

CVE
CVE-2026-94360

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Enrico Marcolini, Claudio Marchesini, Dottor Marc, Naoki Kawahigashi
Submitter
Enrico Marcolini, Claudio Marchesini, Dottor Marc
Submitter website
https://www.dottormarc.it
Verified
Yes
WPVDB ID
f9ef7bfe-3e25-4edf-9c02-3fa9e2873e84

Timeline

Publicly Published
2026-10-12 (about 2 days ago)
Added
2026-10-12 (about 1 day ago)
Last Updated
2026-10-12 (about 1 day ago)

Other

Published
Title
Published
2026-09-09
Title
Robokassa payment gateway for Woocommerce < 1.9.0 - Missing Authorization
Published
2022-06-02
Title
Browser and Operating System Finder <= 1.2 - Unauthenticated Settings Reset
Published
2024-12-11
Title
Minterpress <= 1.0.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
Published
2026-06-01
Title
JTL-Connector for WooCommerce < 2.4.2 - Missing Authorization to Authenticated (Subscriber+) Settings Modification via Multiple Functions
Published
2026-09-10
Title
Client Invoicing by Sprout Invoices < 20.8.16 - Subscriber+ Private Note Overwrite via si_edit_private_note