---
id: "CVE-2026-94295"
kind: "vulnerability"
aliases: ["CVE-2026-94295"]
title: "WooCommerce Google Pay plugin lets anyone mark orders as paid"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "payments", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-25T06:16:33+00:00"
first_seen_at: "2026-10-25T06:36:35+00:00"
updated_at: "2026-10-25T06:37:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94295", "first_seen_at": "2026-10-25T06:36:35+00:00"}]
---

# WooCommerce Google Pay plugin lets anyone mark orders as paid

The Chikkili Google Pay India for WooCommerce plugin, through version 1.0.6, does not check that payment notifications really come from the payment provider. An unauthenticated attacker can send a fake notification and mark any order as paid without paying.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Chikkili Google Pay India for WooCommerce plugin in the WordPress admin under Plugins; unknown whether a fixed version exists.
- Review orders marked paid with no matching payment record at the provider.

## Fix

- Update the Chikkili Google Pay India for WooCommerce plugin past `1.0.6` if a fixed release exists; unknown from the sources.
- Deactivate the plugin until a fix is available if it is not needed.

## Timeline

- 2026-10-25T06:36:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94295

## From the sources

The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before marking the associated order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_