Live › vulnerability › CVE-2026-91075
The Eupago Gateway for WooCommerce WordPress plugin, versions 4.5.0 through 4.7.5, does not verify that payment-confirmation webhook requests are genuine in some configurations. An unauthenticated attacker can send a forged confirmation and get a pending order marked as paid without paying.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 09:19 UTC. All times on this page are UTC.
Stores running the Eupago Gateway for WooCommerce plugin between versions 4.5.0 and 4.7.5 that accept payment webhooks in an affected configuration. The sources say only 'some configurations', so which settings matter is unknown. Stores on other payment gateways or versions outside that range are not affected.
No product ranges from the sources yet.
wp plugin get <plugin-slug> --field=version if WP-CLI is available.4.7.5 (the sources do not name the fixed version).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark a pending order as paid without paying for it.
This page as .md · .json · in your agent: get_signal("CVE-2026-91075")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.