---
id: "CVE-2026-94361"
kind: "vulnerability"
aliases: ["CVE-2026-94361"]
title: "Payable Payment Gateway for WooCommerce: forged payment notices change order status"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "payable-payment-gateway", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed", "plugin-version-1.3.1-or-later"]
published_at: "2026-10-31T06:16:35+00:00"
first_seen_at: "2026-10-31T06:33:50+00:00"
updated_at: "2026-10-31T06:34:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94361", "first_seen_at": "2026-10-31T06:33:50+00:00"}]
---

# Payable Payment Gateway for WooCommerce: forged payment notices change order status

The Payable Payment Gateway plugin for WooCommerce accepts payment notifications without checking they are genuine. An unauthenticated attacker can mark any store order as paid or failed, regardless of how it was paid.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins; the sources say versions before `1.3.1` are affected.
- Confirm whether the Payable gateway is enabled in WooCommerce > Settings > Payments.

## Fix

- Move the Payable Payment Gateway for WooCommerce plugin to `1.3.1` or later.

## Timeline

- 2026-10-31T06:33:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94361

## From the sources

The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed, allowing unauthenticated attackers to change the payment status of any order in the store regardless of the payment method it was placed with.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_