CVE-2026-96173
Received Received - Intake

Unauthorized Order Data Exposure in Hubtel Payments WordPress Plugin

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: WPScan

Description
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-96173
EUVD
EUVD-2026-90518

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
payments_for_hubtel payments_for_hubtel to 1.0.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the Payments for Hubtel WordPress plugin before version 1.0.2. It allows unauthenticated attackers to access sensitive order information by exploiting missing authorization checks during payment-callback requests. Attackers can obtain the order key of any order and view its contents without authentication.

Detection Guidance

To detect this vulnerability, check if the Payments for Hubtel WordPress plugin version is 1.0.2 or earlier. You can use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly. Additionally, monitor network traffic for unauthorized access to order keys during payment callbacks.

Impact Analysis

This vulnerability allows attackers to view sensitive order details, including personal and financial information, without authorization. If you use the Payments for Hubtel plugin before version 1.0.2, your customers' data could be exposed, leading to privacy breaches and potential financial loss.

Compliance Impact

This vulnerability can lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal and sensitive data. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Immediately update the Payments for Hubtel plugin to version 1.0.2 or later. If updating is not possible, consider disabling the plugin temporarily until a patch is applied. Review server logs for any signs of unauthorized access to order information.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96173. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart