{"id":"CVE-2026-94295","kind":"vulnerability","aliases":["CVE-2026-94295"],"related":[],"title":"WooCommerce Google Pay plugin lets anyone mark orders as paid","description":"The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before marking the associated order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made.","summary":"The Chikkili Google Pay India for WooCommerce plugin, through version 1.0.6, does not check that payment notifications really come from the payment provider. An unauthenticated attacker can send a fake notification and mark any order as paid without paying.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","payments","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Chikkili Google Pay India for WooCommerce plugin in the WordPress admin under Plugins; unknown whether a fixed version exists.\n- Review orders marked paid with no matching payment record at the provider.","fix":"- Update the Chikkili Google Pay India for WooCommerce plugin past `1.0.6` if a fixed release exists; unknown from the sources.\n- Deactivate the plugin until a fix is available if it is not needed.","status":"open","published_at":"2026-10-25T06:16:33+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","triaged_at":"2026-10-25T06:37:32+00:00","updated_at":"2026-10-25T06:37:32+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T06:37:32Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Chikkili Google Pay India for WooCommerce plugin past `1.0.6` if a fixed release exists; unknown from the sources.\n- Deactivate the plugin until a fix is available if it is not needed.","reach":"internet","title":"WooCommerce Google Pay plugin lets anyone mark orders as paid","impact":"medium","summary":"The Chikkili Google Pay India for WooCommerce plugin, through version 1.0.6, does not check that payment notifications really come from the payment provider. An unauthenticated attacker can send a fake notification and mark any order as paid without paying.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","payments"],"confidence":0.7,"needs_auth":"no","worst_case":"Attackers mark orders paid without paying, causing goods to ship unpaid.","analyst_note":"Confirm the fixed version and the vulnerable notification endpoint from the NVD entry or the plugin's changelog.","how_to_check":"- Check the installed version of the Chikkili Google Pay India for WooCommerce plugin in the WordPress admin under Plugins; unknown whether a fixed version exists.\n- Review orders marked paid with no matching payment record at the provider.","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Stores running the Chikkili Google Pay India for WooCommerce plugin version 1.0.6 or earlier are exposed, because the payment notification endpoint accepts requests without verifying the sender. Sites that do not use this plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000625,"input_tokens":3314,"output_tokens":587,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-94295':13A,16A '1.0.6':31B,70C 'actual':78C 'allow':91C 'anyon':6A 'arbitrari':96C 'associ':87C 'attack':46B,93C 'check':34B 'chikkili':22B,61C 'come':39B 'cve':11A,14A 'fake':50B 'googl':2A,23B,62C 'india':25B,64C 'let':5A 'made':104C 'mark':7A,53B,85C,95C 'notif':37B,51B,77C 'order':8A,55B,88C,97C 'origin':79C 'packag':17B 'paid':10A,57B,90C,99C 'pay':3A,24B,59B,63C 'payment':18B,36B,42B,76C,82C,102C 'plugin':4A,28B,68C 'provid':43B,83C 'realli':38B 'send':48B 'unauthent':45B,92C 'verifi':73C 'version':30B 'without':58B,100C 'woocommerc':1A,19B,27B,66C 'wordpress':20B,67C","nicknames":[],"mitigations":[],"who_affected":"Stores running the Chikkili Google Pay India for WooCommerce plugin version 1.0.6 or earlier are exposed, because the payment notification endpoint accepts requests without verifying the sender. Sites that do not use this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T06:16:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94295","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94295","severity":null,"published_at":"2026-10-25T06:16:33+00:00","modified_at":"2026-10-25T06:16:33+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","fetched_at":"2026-10-25T06:36:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}