CVE-2026-111957
Deferred Deferred - Pending Action

Unauthenticated Payment Replay in SUMIT Payment Gateway for WooCommerce

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: WPScan

Description
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being completed, nor check the payment amount against the order total, allowing unauthenticated users to mark a pending order as paid by replaying a payment identifier obtained from any single genuine payment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-09
NVD
CVE-2026-111957
EUVD
EUVD-2026-107079

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown SUMIT Payment Gateway for WooCommerce 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The SUMIT Payment Gateway plugin for WooCommerce before version 4.0.0 has a flaw where it fails to link confirmed payments with specific orders or verify payment amounts against order totals. This allows unauthenticated users to exploit payment identifiers from legitimate transactions to mark unrelated pending orders as paid by replaying those identifiers.

Detection Guidance

Check if the SUMIT Payment Gateway for WooCommerce plugin version is below 4.0.0. Inspect network traffic for unauthenticated payment confirmation requests that replay payment identifiers without proper order association.

Impact Analysis

This vulnerability could allow attackers to trick your store into marking fraudulent or unrelated orders as paid without actually processing valid payments. This may result in financial losses, incorrect order fulfillment, and potential disputes with customers over unpaid orders marked as completed.

Compliance Impact

This vulnerability could lead to unauthorized transactions being marked as paid, potentially violating financial transaction integrity requirements in standards like GDPR (data protection) and HIPAA (healthcare transactions). Unauthorized order confirmations may expose organizations to compliance risks due to improper access control and lack of payment verification.

Mitigation Strategies

Update the SUMIT Payment Gateway for WooCommerce plugin to version 4.0.0 or later immediately. Review pending orders for unauthorized payment confirmations and verify transaction logs for anomalies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111957. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...