CVE-2026-105975

Deferred Deferred - Pending Action

Unauthenticated Payment Manipulation in CamPay Shortcode Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parameters, allowing unauthenticated attackers to mark payment records as paid, destroy genuine payment records, and write CamPay Shortcode Payment Gateway WordPress plugin before 1.7 meta onto arbitrary posts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105975

EUVD

EUVD-2026-100880

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	CamPay	Shortcode Payment Gateway 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-105975 affects the CamPay Shortcode Payment Gateway WordPress plugin before version 1.7. The vulnerability allows unauthenticated attackers to forge payment statuses by manipulating client-supplied parameters instead of verifying authentic Mobile Money payment confirmations. This can lead to marking fake payments as paid, deleting legitimate payment records, or injecting plugin metadata into arbitrary posts.

Detection Guidance

Check the installed version of the CamPay Shortcode Payment Gateway plugin. If it is below 1.7, the system is vulnerable. Look for unauthorized modifications to payment records or unexpected plugin metadata in posts.

Impact Analysis

If you use the affected plugin, attackers could manipulate payment records, causing financial losses or incorrect transaction tracking. Legitimate payments might be deleted or marked as unpaid, while fake payments could be recorded. This could disrupt business operations and lead to disputes with customers.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by compromising financial transaction integrity and data accuracy. Incorrect payment records may violate audit trails, data protection, and financial reporting requirements, potentially resulting in legal or regulatory penalties.

Mitigation Strategies

Update the CamPay Shortcode Payment Gateway plugin to version 1.7 or later immediately. Review payment records for signs of tampering and remove any unauthorized metadata from posts.

Hi! I’m here to help you understand CVE-2026-105975. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70