CVE-2026-94360

Deferred Deferred - Pending Action

Paymentfor Gateway WooCommerce Order Status Manipulation

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as paid, allowing unauthenticated attackers to mark orders as paid without any payment being completed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-94360

EUVD

EUVD-2026-100868

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Paymentfor	Gateway for WooCommerce 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Paymentfor Gateway for WooCommerce plugin before version 1.0.6. It allows unauthenticated attackers to forge order payments by exploiting unverified payment callbacks. The plugin does not check if incoming payment notifications are legitimate, letting attackers mark orders as paid without completing any actual payment.

Detection Guidance

Check the installed version of the Paymentfor Gateway for WooCommerce plugin. If it is below 1.0.6, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the plugin version.

Impact Analysis

Unauthenticated attackers could exploit this to trick the system into marking orders as paid without real transactions. This could lead to financial losses for merchants, as orders may appear completed when no payment was made. Customers might also receive incorrect order confirmations.

Compliance Impact

This vulnerability could lead to unauthorized transactions being recorded as paid, potentially violating data integrity and financial compliance requirements under standards like GDPR (data accuracy) and HIPAA (financial record integrity). Unverified payment notifications may result in incorrect financial records, which could impact audit trails and regulatory reporting.

Mitigation Strategies

Update the Paymentfor Gateway for WooCommerce plugin to version 1.0.6 or later immediately. Disable the plugin temporarily if an update is not immediately available. Monitor order statuses for unauthorized changes.

Hi! I’m here to help you understand CVE-2026-94360. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70