Unauthenticated Payment Bypass in Integrate PhonePe with WooCommerce

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: WPScan

Description

The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the order being marked as paid, nor does it verify the authenticity of its payment-completion request, allowing unauthenticated attackers to reuse a single valid transaction to mark arbitrary orders as paid and bypass payment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-10599

Affected Vendors & Products

Vendor	Product	Version / Range
phonepe	woocommerce_plugin	1.2.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Integrate PhonePe with WooCommerce WordPress plugin version 1.2.1 or earlier. It allows attackers to exploit a flaw where the plugin does not check if a payment transaction is linked to the correct order. As a result, an attacker can use a single valid transaction to mark any order as paid without proper verification.

Impact Analysis

If you use this plugin, attackers could bypass payment for orders, leading to financial losses. Your store might fulfill orders without receiving payment, affecting revenue and customer trust. The plugin's lack of transaction verification exposes all orders to unauthorized payment marking.

Mitigation Strategies

Update the Integrate PhonePe with WooCommerce plugin to the latest version immediately. Disable the plugin temporarily if an update is not available. Review all orders marked as paid to verify their authenticity. Monitor for unauthorized transactions or order modifications.

Hi! I’m here to help you understand CVE-2026-10599. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70