Live › vulnerability › CVE-2026-86791
Go to dashboardThe iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not check that a payment was completed before marking an order as paid. An unauthenticated visitor can mark any unpaid order as paid and change its total.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the iPOSpays Payment Gateway for WooCommerce plugin before 1.4.7 that accept orders through it. Sites without this plugin can skip it.
No product ranges from the sources yet.
1.4.7 are affected.1.4.7 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually completed before recording an order as paid, allowing unauthenticated users to mark any unpaid order as paid and to rewrite its total.
This page as .md · .json · in your agent: get_signal("CVE-2026-86791")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.