Live › vulnerability › CVE-2026-88928
The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when a request references a tokenisation operation. An unauthenticated attacker can overwrite stored payment tokens tied to existing orders and delete saved card records.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 06:53 UTC. All times on this page are UTC.
Stores running the PAYCOMET for WooCommerce plugin before version 5.46 on WordPress with WooCommerce. The payment notification endpoint is reachable without authentication, so any site on the internet running an affected version is exposed. Sites on newer plugin versions or without this plugin can skip it.
No product ranges from the sources yet.
5.46 are in the affected range.5.46Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwrite the stored payment token associated with existing orders and delete saved card records.
This page as .md · .json · in your agent: get_signal("CVE-2026-88928")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.