---
id: "CVE-2026-111957"
kind: "vulnerability"
aliases: ["CVE-2026-111957"]
title: "SUMIT WooCommerce gateway: unauthenticated users can mark unpaid orders paid"
severity: "medium"
cvss: 5.3
epss: 0.0019
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "payments", "woocommerce", "wordpress"]
not_affected_if: ["plugin-4.0.0-or-later", "plugin-not-installed"]
published_at: "2026-10-21T06:16:48+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T04:21:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111957", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-111957", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# SUMIT WooCommerce gateway: unauthenticated users can mark unpaid orders paid

The SUMIT Payment Gateway plugin for WooCommerce, before version 4.0.0, does not tie a confirmed payment to the order being completed or check the amount against the order total. An unauthenticated attacker can replay a payment identifier from one genuine payment to mark a pending order as paid.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the SUMIT Payment Gateway for WooCommerce plugin in the WordPress admin plugin list; versions below `4.0.0` are affected.
- Review WooCommerce orders paid through SUMIT for amounts that do not match the order total or payment identifiers reused across orders.

## Fix

- Update the SUMIT Payment Gateway for WooCommerce plugin to `4.0.0` or later.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111957
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-111957

## From the sources

The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being completed, nor check the payment amount against the order total, allowing unauthenticated users to mark a pending order as paid by replaying a payment identifier obtained from any single genuine payment.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_