{"id":"CVE-2026-94361","kind":"vulnerability","aliases":["CVE-2026-94361"],"related":[],"title":"Payable Payment Gateway for WooCommerce: forged payment notices change order status","description":"The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed, allowing unauthenticated attackers to change the payment status of any order in the store regardless of the payment method it was placed with.","summary":"The Payable Payment Gateway plugin for WooCommerce accepts payment notifications without checking they are genuine. An unauthenticated attacker can mark any store order as paid or failed, regardless of how it was paid.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","payable-payment-gateway","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","plugin-version-1.3.1-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; the sources say versions before `1.3.1` are affected.\n- Confirm whether the Payable gateway is enabled in WooCommerce > Settings > Payments.","fix":"- Move the Payable Payment Gateway for WooCommerce plugin to `1.3.1` or later.","status":"open","published_at":"2026-10-31T06:16:35+00:00","first_seen_at":"2026-10-31T06:33:50+00:00","triaged_at":"2026-10-31T06:34:21+00:00","updated_at":"2026-10-31T06:34:21+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T06:34:21Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Payable Payment Gateway for WooCommerce plugin to `1.3.1` or later.","reach":"internet","title":"Payable Payment Gateway for WooCommerce: forged payment notices change order status","impact":"medium","summary":"The Payable Payment Gateway plugin for WooCommerce accepts payment notifications without checking they are genuine. An unauthenticated attacker can mark any store order as paid or failed, regardless of how it was paid.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","payable-payment-gateway"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker marks any store order paid or failed without paying","analyst_note":"Check the NVD entry and the plugin's changelog to confirm the exact notification endpoint and whether any default configuration is required.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; the sources say versions before `1.3.1` are affected.\n- Confirm whether the Payable gateway is enabled in WooCommerce > Settings > Payments.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-version-1.3.1-or-later"],"who_is_affected":"Online stores running WooCommerce with the Payable Payment Gateway plugin installed and active are exposed. The notification handler is reachable without logging in, so any store with the plugin before version 1.3.1 is exposed; stores without this gateway can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000702,"input_tokens":4131,"output_tokens":577,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-94361':14A,17A '1.3.1':67C 'accept':32B 'allow':86C 'attack':42B,88C 'authent':72C 'chang':9A,90C 'check':36B 'cve':12A,15A 'fail':51B,85C 'forg':6A 'gateway':3A,22B,28B,61C 'genuin':39B 'incom':75C 'mark':44B,79C 'method':104C 'notic':8A 'notif':34B,77C 'order':10A,47B,82C,96C 'packag':18B 'paid':49B,57B,83C 'payabl':1A,20B,26B,59C 'payable-payment-gateway':19B 'payment':2A,7A,21B,27B,33B,60C,76C,92C,103C 'place':107C 'plugin':29B,65C 'regardless':52B,100C 'status':11A,93C 'store':46B,99C 'unauthent':41B,87C 'verifi':70C 'without':35B 'woocommerc':5A,23B,31B,63C,81C 'wordpress':24B,64C","nicknames":[],"mitigations":[],"who_affected":"Online stores running WooCommerce with the Payable Payment Gateway plugin installed and active are exposed. The notification handler is reachable without logging in, so any store with the plugin before version 1.3.1 is exposed; stores without this gateway can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T06:16:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94361","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94361","severity":null,"published_at":"2026-10-31T06:16:35+00:00","modified_at":"2026-10-31T06:16:35+00:00","first_seen_at":"2026-10-31T06:33:50+00:00","fetched_at":"2026-10-31T06:33:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}