CVE-2026-84043
Received Received - Intake

Unauthenticated Payment Confirmation Bypass in ePayco Payment Gateway for WooCommerce

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: WPScan

Description
The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signature.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-84043
EUVD
EUVD-2026-70991

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
epayco payment_gateway_for_woocommerce to 8.4.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The ePayco Payment Gateway for WooCommerce plugin before version 8.4.7 has a flaw where it does not verify if payment confirmation requests are legitimate. This allows attackers to trick the system into marking orders as paid without a valid payment gateway signature.

Detection Guidance

Check the installed version of the ePayco Payment Gateway for WooCommerce plugin. If it is below 8.4.7, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' if using WP-CLI to verify the version.

Impact Analysis

This vulnerability could lead to financial losses if attackers mark unpaid orders as paid, causing merchants to ship products without receiving payment. It may also damage customer trust and business reputation.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized transactions to be marked as paid without proper verification. For GDPR, this may affect data integrity and security requirements. For HIPAA, it could compromise financial transaction security in healthcare systems.

Mitigation Strategies

Immediately update the ePayco Payment Gateway for WooCommerce plugin to version 8.4.7 or later. Disable the plugin temporarily if an update is not immediately available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84043. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart