CVE-2026-94361
PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned Callback
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed, allowing unauthenticated attackers to change the payment status of any order in the store regardless of the payment method it was placed with.
| Vendor | unknown |
| Product | payable payment gateway for woocommerce |
| Published | Oct 31, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown payable payment gateway for woocommerce
Be the first to know when new unknown vulnerabilities affecting unknown payable payment gateway for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Payable Payment Gateway for WooCommerce
0 < 1.3.1
References
Credits
Enrico Marcolini Claudio Marchesini Dottor Marc WPScan