{"id":"CVE-2026-91075","kind":"vulnerability","aliases":["CVE-2026-91075"],"related":[],"title":"Eupago Gateway WooCommerce plugin: forged webhooks can mark unpaid orders paid","description":"The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark a pending order as paid without paying for it.","summary":"The Eupago Gateway for WooCommerce WordPress plugin, versions 4.5.0 through 4.7.5, does not verify that payment-confirmation webhook requests are genuine in some configurations. An unauthenticated attacker can send a forged confirmation and get a pending order marked as paid without paying.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["eupago","package","payments","woocommerce","wordpress"],"not_affected_if":["other-gateway","other-version"],"how_to_check":"- Check the installed version of the Eupago Gateway for WooCommerce plugin in the WordPress plugins list, or with `wp plugin get <plugin-slug> --field=version` if WP-CLI is available.\n- Confirm whether the Eupago webhook is configured on your store and whether the plugin's webhook verification is enabled in its settings; the sources do not say which settings are affected.","fix":"- Eupago Gateway for WooCommerce: versions after `4.7.5` (the sources do not name the fixed version).","status":"open","published_at":"2026-11-03T09:17:13+00:00","first_seen_at":"2026-11-03T09:19:51+00:00","triaged_at":"2026-11-03T09:20:26+00:00","updated_at":"2026-11-03T09:20:26+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T09:20:26Z","model":"claude-haiku-5-5","output":{"fix":"- Eupago Gateway for WooCommerce: versions after `4.7.5` (the sources do not name the fixed version).","reach":"internet","title":"Eupago Gateway WooCommerce plugin: forged webhooks can mark unpaid orders paid","impact":"medium","summary":"The Eupago Gateway for WooCommerce WordPress plugin, versions 4.5.0 through 4.7.5, does not verify that payment-confirmation webhook requests are genuine in some configurations. An unauthenticated attacker can send a forged confirmation and get a pending order marked as paid without paying.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","eupago","payments"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker marks unpaid orders as paid without paying","analyst_note":"Check the NVD entry and the plugin's changelog for the fixed version and the exact configuration that triggers the flaw.","how_to_check":"- Check the installed version of the Eupago Gateway for WooCommerce plugin in the WordPress plugins list, or with `wp plugin get <plugin-slug> --field=version` if WP-CLI is available.\n- Confirm whether the Eupago webhook is configured on your store and whether the plugin's webhook verification is enabled in its settings; the sources do not say which settings are affected.","plain_action":"","needs_analyst":true,"not_affected_if":["other-version","other-gateway"],"who_is_affected":"Stores running the Eupago Gateway for WooCommerce plugin between versions 4.5.0 and 4.7.5 that accept payment webhooks in an affected configuration. The sources say only 'some configurations', so which settings matter is unknown. Stores on other payment gateways or versions outside that range are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000752,"input_tokens":4146,"output_tokens":674,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-91075':14A,17A '4.5.0':31B,74C '4.7.5':33B,76C 'allow':92C 'attack':50B,94C 'authent':81C 'configur':47B,91C 'confirm':40B,55B,86C,99C 'cve':12A,15A 'eupago':1A,18B,24B,67C 'forg':5A,54B,96C 'gateway':2A,25B,68C 'genuin':44B 'get':57B 'incom':83C 'mark':8A,61B,101C 'order':10A,60B,104C 'packag':19B 'paid':11A,63B,106C 'pay':65B,108C 'payment':20B,39B,85C,98C 'payment-confirm':38B,84C 'pend':59B,103C 'plugin':4A,29B,72C 'request':42B,88C 'send':52B 'unauthent':49B,93C 'unpaid':9A 'verifi':36B,79C 'version':30B 'webhook':6A,41B,87C 'without':64B,107C 'woocommerc':3A,21B,27B,70C 'wordpress':22B,28B,71C","nicknames":[],"mitigations":[],"who_affected":"Stores running the Eupago Gateway for WooCommerce plugin between versions 4.5.0 and 4.7.5 that accept payment webhooks in an affected configuration. The sources say only 'some configurations', so which settings matter is unknown. Stores on other payment gateways or versions outside that range are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["eupago","medium","package","payments","woocommerce","wordpress"],"first_public_at":"2026-11-03T09:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91075","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91075","severity":null,"published_at":"2026-11-03T09:17:13+00:00","modified_at":"2026-11-03T09:17:13+00:00","first_seen_at":"2026-11-03T09:19:51+00:00","fetched_at":"2026-11-03T09:19:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}