CVE-2026-16738
Received Received - Intake

Unauthenticated Payment Bypass in Conekta Payment Gateway WordPress Plugin

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: WPScan

Description
The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount, allowing unauthenticated attackers to mark arbitrary orders as paid without payment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-16738
EUVD
EUVD-2026-64218

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
conekta payment_gateway to 6.2.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Conekta Payment Gateway WordPress plugin before version 6.2.2. It allows unauthenticated attackers to forge webhook notifications and mark arbitrary orders as paid without processing actual payments. The plugin fails to verify the authenticity of incoming webhook notifications, bind payments to correct orders, or validate payment amounts.

Detection Guidance

Check the installed version of the Conekta Payment Gateway WordPress plugin. If it is below 6.2.2, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin directory for version details.

Impact Analysis

Attackers could exploit this to trick the system into marking orders as paid without receiving real payments. This could lead to financial losses for merchants, incorrect order fulfillment, and potential disputes with customers. Unauthorized access to order status may also occur.

Compliance Impact

This vulnerability could lead to unauthorized transactions being marked as paid, potentially violating data integrity and financial compliance requirements under standards like GDPR (data protection) and HIPAA (healthcare transactions). Unverified webhook notifications may expose sensitive payment data to attackers, risking non-compliance with privacy and security controls.

Mitigation Strategies

Update the Conekta Payment Gateway plugin to version 6.2.2 or later immediately. Disable webhook notifications temporarily if an update is not possible, and monitor for unauthorized order confirmations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16738. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart