Live › vulnerability › CVE-2026-111957
Go to dashboardThe SUMIT Payment Gateway plugin for WooCommerce, before version 4.0.0, does not tie a confirmed payment to the order being completed or check the amount against the order total. An unauthenticated attacker can replay a payment identifier from one genuine payment to mark a pending order as paid.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Stores running the SUMIT Payment Gateway for WooCommerce plugin before 4.0.0 that accept payments through SUMIT are exposed. The flaw sits in the payment confirmation path, so sites that do not use this gateway can skip it.
No product ranges from the sources yet.
4.0.0 are affected.4.0.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being completed, nor check the payment amount against the order total, allowing unauthenticated users to mark a pending order as paid by replaying a payment identifier obtained from any single genuine payment.
This page as .md · .json · in your agent: get_signal("CVE-2026-111957")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.