CVE-2026-88928
PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification Bypass
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwrite the stored payment token associated with existing orders and delete saved card records.
| Vendor | unknown |
| Product | paycomet for woocommerce |
| Published | Oct 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown paycomet for woocommerce
Be the first to know when new unknown vulnerabilities affecting unknown paycomet for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / PAYCOMET for WooCommerce
5.36 < 5.46
References
Credits
JunHee CHO WPScan