{"id":"CVE-2026-88928","kind":"vulnerability","aliases":["CVE-2026-88928"],"related":[],"title":"PAYCOMET for WooCommerce: unsigned payment callbacks let attackers alter saved cards","description":"The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwrite the stored payment token associated with existing orders and delete saved card records.","summary":"The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when a request references a tokenisation operation. An unauthenticated attacker can overwrite stored payment tokens tied to existing orders and delete saved card records.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","paycomet","payments","woocommerce","wordpress"],"not_affected_if":["plugin-5.46-or-later"],"how_to_check":"- Check the installed version of the PAYCOMET for WooCommerce plugin in the WordPress admin plugins list; versions below `5.46` are in the affected range.\n- Review the plugin's payment notification endpoint and whether it is reachable from the internet.","fix":"- PAYCOMET for WooCommerce: `5.46`","status":"open","published_at":"2026-10-29T06:17:24+00:00","first_seen_at":"2026-10-29T06:53:14+00:00","triaged_at":"2026-10-29T06:54:34+00:00","updated_at":"2026-10-29T06:54:34+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T06:54:34Z","model":"claude-haiku-5-5","output":{"fix":"- PAYCOMET for WooCommerce: `5.46`","reach":"internet","title":"PAYCOMET for WooCommerce: unsigned payment callbacks let attackers alter saved cards","impact":"medium","summary":"The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when a request references a tokenisation operation. An unauthenticated attacker can overwrite stored payment tokens tied to existing orders and delete saved card records.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","paycomet","payments"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attackers overwrite stored payment tokens and delete saved cards","analyst_note":"","how_to_check":"- Check the installed version of the PAYCOMET for WooCommerce plugin in the WordPress admin plugins list; versions below `5.46` are in the affected range.\n- Review the plugin's payment notification endpoint and whether it is reachable from the internet.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-5.46-or-later"],"who_is_affected":"Stores running the PAYCOMET for WooCommerce plugin before version 5.46 on WordPress with WooCommerce. The payment notification endpoint is reachable without authentication, so any site on the internet running an affected version is exposed. Sites on newer plugin versions or without this plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000699,"input_tokens":4126,"output_tokens":573,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-88928':14A,17A '5.46':30B,73C 'allow':92C 'alter':9A 'associ':101C 'attack':8A,51B,94C 'callback':6A 'card':11A,64B,108C 'cryptograph':35B,78C 'cve':12A,15A 'delet':62B,106C 'endpoint':41B,84C 'exist':59B,103C 'let':7A 'notif':40B,83C 'oper':48B,91C 'order':60B,104C 'overwrit':53B,96C 'packag':18B 'paycomet':1A,19B,24B,67C 'payment':5A,20B,39B,55B,82C,99C 'plugin':28B,71C 'record':65B,109C 'refer':45B,88C 'request':44B,87C 'save':10A,63B,107C 'signatur':36B,79C 'store':54B,98C 'tie':57B 'token':56B,100C 'tokenis':47B,90C 'unauthent':50B,93C 'unsign':4A 'verifi':33B,76C 'woocommerc':3A,21B,26B,69C 'wordpress':22B,27B,70C","nicknames":[],"mitigations":[],"who_affected":"Stores running the PAYCOMET for WooCommerce plugin before version 5.46 on WordPress with WooCommerce. The payment notification endpoint is reachable without authentication, so any site on the internet running an affected version is exposed. Sites on newer plugin versions or without this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T06:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88928","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88928","severity":null,"published_at":"2026-10-29T06:17:24+00:00","modified_at":"2026-10-29T06:17:24+00:00","first_seen_at":"2026-10-29T06:53:14+00:00","fetched_at":"2026-10-29T06:53:14+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}