Live › vulnerability › CVE-2026-94361
The Payable Payment Gateway plugin for WooCommerce accepts payment notifications without checking they are genuine. An unauthenticated attacker can mark any store order as paid or failed, regardless of how it was paid.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 06:33 UTC. All times on this page are UTC.
Online stores running WooCommerce with the Payable Payment Gateway plugin installed and active are exposed. The notification handler is reachable without logging in, so any store with the plugin before version 1.3.1 is exposed; stores without this gateway can skip it.
No product ranges from the sources yet.
1.3.1 are affected.1.3.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed, allowing unauthenticated attackers to change the payment status of any order in the store regardless of the payment method it was placed with.
This page as .md · .json · in your agent: get_signal("CVE-2026-94361")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.