CVE-2026-87843
Deferred Deferred - Pending Action

Authentication Bypass in Trust Payments Gateway for WooCommerce

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description
The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from the hosted payment page, nor bind that response to the targeted order or check the amount, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made, and to retrieve order and customer details.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-14
Last Modified
2026-10-14
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-87843
EUVD
EUVD-2026-100856

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Trust Payments Gateway for WooCommerce 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Trust Payments Gateway for WooCommerce plugin before version 3.1.0. It allows unauthenticated attackers to mark arbitrary orders as paid without making any payment by exploiting improper verification of payment provider responses when customers return from the hosted payment page. The plugin fails to bind responses to specific orders or validate payment amounts.

Detection Guidance

Check the installed version of the Trust Payments Gateway for WooCommerce plugin. If it is below 3.1.0, the system is vulnerable. Use commands like 'wp plugin list' in WordPress or inspect the plugin files directly.

Impact Analysis

Attackers could exploit this to complete orders without payment, leading to financial losses. They may also access sensitive order and customer details, violating privacy. Businesses using the vulnerable plugin risk fraudulent transactions and data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to customer data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Update the Trust Payments Gateway for WooCommerce plugin to version 3.1.0 or later immediately to patch the vulnerability. Disable the plugin temporarily if an update is not immediately available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87843. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart