CVE-2026-106014
Deferred Deferred - Pending Action

Unauthenticated Payment Bypass in Vantiv WC WordPress Plugin

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: WPScan

Description
The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hosted-payment return handler, allowing unauthenticated attackers to mark orders as paid without actually paying.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-11-08
AI Q&A
2026-10-19
EPSS Evaluated
2026-11-07
NVD
CVE-2026-106014
EUVD
EUVD-2026-104087

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Gateway for Vantiv on WC 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Gateway for Vantiv on WC WordPress plugin through version 1.0.1 has a flaw where it does not verify if payment notifications are authentic. This allows attackers to forge payment callbacks and mark orders as paid without actually processing any payment.

Detection Guidance

Check if the Gateway for Vantiv on WC WordPress plugin version 1.0.1 or below is installed. Look for unauthorized order status changes marked as paid without actual transactions. Monitor payment callback logs for suspicious activity or forged notifications.

Impact Analysis

This vulnerability could lead to financial losses as orders may be marked as paid without actual transactions. It also undermines trust in the payment system and could result in disputes or chargebacks.

Compliance Impact

This vulnerability allows unauthenticated attackers to mark orders as paid without actual payment, which could lead to unauthorized transactions and financial losses. For compliance with standards like GDPR or HIPAA, this flaw may violate data integrity and security requirements, as it undermines payment verification processes and could expose sensitive payment data to unauthorized manipulation.

Mitigation Strategies

Disable or remove the Gateway for Vantiv on WC plugin immediately. Implement server-side validation for payment notifications to ensure authenticity. Monitor order statuses for unauthorized changes and review transaction logs for anomalies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106014. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...