Live › vulnerability › CVE-2026-94295
Go to dashboardThe Chikkili Google Pay India for WooCommerce plugin, through version 1.0.6, does not check that payment notifications really come from the payment provider. An unauthenticated attacker can send a fake notification and mark any order as paid without paying.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 06:36 UTC. All times on this page are UTC.
Stores running the Chikkili Google Pay India for WooCommerce plugin version 1.0.6 or earlier are exposed, because the payment notification endpoint accepts requests without verifying the sender. Sites that do not use this plugin can skip it.
No product ranges from the sources yet.
1.0.6 if a fixed release exists; unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before marking the associated order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made.
This page as .md · .json · in your agent: get_signal("CVE-2026-94295")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.