{"id":"CVE-2026-94360","title":"The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as paid, allowing unauthenticated attackers to mark orders as paid without a…","summary":"The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as paid, allowing unauthenticated attackers to mark orders as paid without a…","severity":"none","published":"2026-10-14","updated":"2026-10-14","sourceUpdated":"2026-10-14T07:17:05.573","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94360","references":[{"url":"https://wpscan.com/vulnerability/f9ef7bfe-3e25-4edf-9c02-3fa9e2873e84/","label":"contact@wpscan.com"}],"tags":["nvd"],"ingestedAt":"2026-10-14T07:21:04.848Z","slug":"CVE-2026-94360","body":"## Overview\n\nThe Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as paid, allowing unauthenticated attackers to mark orders as paid without any payment being completed.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}