CVE-2026-10599

Deferred Deferred - Pending Action

Unauthenticated Payment Bypass in Integrate PhonePe with WooCommerce

Publication date: 2026-08-06

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the order being marked as paid, nor does it verify the authenticity of its payment-completion request, allowing unauthenticated attackers to reuse a single valid transaction to mark arbitrary orders as paid and bypass payment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-07

EPSS Evaluated

2026-08-26

NVD

CVE-2026-10599

Affected Vendors & Products

Vendor	Product	Version / Range
phonepe	woocommerce_plugin	1.2.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Integrate PhonePe with WooCommerce WordPress plugin version 1.2.1 or earlier. It allows attackers to exploit a flaw where the plugin does not check if a payment transaction is linked to the correct order. As a result, an attacker can use a single valid transaction to mark any order as paid without proper verification.

Detection Guidance

This vulnerability can be detected by checking if the WooCommerce plugin 'Integrate PhonePe with WooCommerce' is installed and its version is 1.2.1 or below. Review payment logs for suspicious transactions marked as paid without proper verification. No specific commands are provided in the context.

Impact Analysis

If you use this plugin, attackers could bypass payment for orders, leading to financial losses. Your store might fulfill orders without receiving payment, affecting revenue and customer trust. The plugin's lack of transaction verification exposes all orders to unauthorized payment marking.

Compliance Impact

This vulnerability allows attackers to bypass payment verification, potentially leading to unauthorized access to paid services or products. This could result in financial losses for businesses and expose them to non-compliance with regulations requiring secure payment processing and data protection.

Mitigation Strategies

Update the Integrate PhonePe with WooCommerce plugin to the latest version immediately. Disable the plugin temporarily if an update is not available. Review all orders marked as paid to verify their authenticity. Monitor for unauthorized transactions or order modifications.

Hi! I’m here to help you understand CVE-2026-10599. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70