{"id":"CVE-2026-111957","kind":"vulnerability","aliases":["CVE-2026-111957"],"related":[],"title":"SUMIT WooCommerce gateway: unauthenticated users can mark unpaid orders paid","description":"The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being completed, nor check the payment amount against the order total, allowing unauthenticated users to mark a pending order as paid by replaying a payment identifier obtained from any single genuine payment.","summary":"The SUMIT Payment Gateway plugin for WooCommerce, before version 4.0.0, does not tie a confirmed payment to the order being completed or check the amount against the order total. An unauthenticated attacker can replay a payment identifier from one genuine payment to mark a pending order as paid.","severity":"medium","cvss":5.3,"epss":0.0019,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","payments","woocommerce","wordpress"],"not_affected_if":["plugin-4.0.0-or-later","plugin-not-installed"],"how_to_check":"- Check the installed version of the SUMIT Payment Gateway for WooCommerce plugin in the WordPress admin plugin list; versions below `4.0.0` are affected.\n- Review WooCommerce orders paid through SUMIT for amounts that do not match the order total or payment identifiers reused across orders.","fix":"- Update the SUMIT Payment Gateway for WooCommerce plugin to `4.0.0` or later.","status":"open","published_at":"2026-10-21T06:16:48+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:21:10+00:00","updated_at":"2026-10-25T04:21:10+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:21:10Z","model":"claude-haiku-5-5","output":{"fix":"- Update the SUMIT Payment Gateway for WooCommerce plugin to `4.0.0` or later.","reach":"internet","title":"SUMIT WooCommerce gateway: unauthenticated users can mark unpaid orders paid","impact":"medium","summary":"The SUMIT Payment Gateway plugin for WooCommerce, before version 4.0.0, does not tie a confirmed payment to the order being completed or check the amount against the order total. An unauthenticated attacker can replay a payment identifier from one genuine payment to mark a pending order as paid.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","payments"],"confidence":0.7,"needs_auth":"no","worst_case":"unpaid orders get marked paid, so goods ship without payment","analyst_note":"Confirm the affected version range and whether a vendor advisory or changelog for 4.0.0 names the exact fix; the sources give only the NVD description and EPSS score.","how_to_check":"- Check the installed version of the SUMIT Payment Gateway for WooCommerce plugin in the WordPress admin plugin list; versions below `4.0.0` are affected.\n- Review WooCommerce orders paid through SUMIT for amounts that do not match the order total or payment identifiers reused across orders.","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-4.0.0-or-later"],"who_is_affected":"Stores running the SUMIT Payment Gateway for WooCommerce plugin before 4.0.0 that accept payments through SUMIT are exposed. The flaw sits in the payment confirmation path, so sites that do not use this gateway can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000648,"input_tokens":3380,"output_tokens":621,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111957':13A,16A '-2026':12A,15A '4.0.0':30B,78C 'allow':103C 'amount':45B,98C 'attack':52B 'bind':81C 'check':43B,95C 'complet':41B,93C 'confirm':35B,85C 'cve':11A,14A 'gateway':3A,24B,72C 'genuin':60B,122C 'identifi':57B,117C 'mark':7A,63B,107C 'obtain':118C 'one':59B 'order':9A,39B,48B,66B,91C,101C,110C 'packag':17B 'paid':10A,68B,112C 'payment':18B,23B,36B,56B,61B,71C,83C,97C,116C,123C 'pend':65B,109C 'plugin':25B,76C 'provid':88C 'replay':54B,114C 'singl':121C 'sumit':1A,22B,70C 'tie':33B 'total':49B,102C 'unauthent':4A,51B,104C 'unpaid':8A 'user':5A,105C 'version':29B 'woocommerc':2A,19B,27B,74C 'wordpress':20B,75C","nicknames":[],"mitigations":[],"who_affected":"Stores running the SUMIT Payment Gateway for WooCommerce plugin before 4.0.0 that accept payments through SUMIT are exposed. The flaw sits in the payment confirmation path, so sites that do not use this gateway can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111957","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111957","severity":null,"published_at":"2026-10-21T06:16:48+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111957","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111957","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}