CVE-2026-105975
CamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forgery via external_reference
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parameters, allowing unauthenticated attackers to mark payment records as paid, destroy genuine payment records, and write CamPay Shortcode Payment Gateway WordPress plugin before 1.7 meta onto arbitrary posts.
| Vendor | unknown |
| Product | campay shortcode payment gateway |
| Published | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown campay shortcode payment gateway
Be the first to know when new unknown vulnerabilities affecting unknown campay shortcode payment gateway are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / CamPay Shortcode Payment Gateway
0 < 1.7
References
Credits
Pablo González Pérez Francisco José Ramírez Vicente and Iñigo Sánchez Enciso WPScan