---
id: CVE-2026-106014
title: >-
  Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion
  via Payment Callback Forgery
summary: >-
  The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify
  the authenticity of the payment notification received on its hosted-payment
  return handler, allowing unauthenticated attackers to mark orders as paid
  without act…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-284
product: Gateway for Vantiv on WC
affected:
  - gateway_for_vantiv_on_wc <= 1.0.1
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-19T09:22:39.472299Z'
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T09:31:19.387Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-106014'
references:
  - url: 'https://wpscan.com/vulnerability/30ccd424-a0a1-40a9-93ab-5def94eb0073/'
tags:
  - cve.org
ingestedAt: '2026-10-19T07:09:59.597Z'
epss: 0.00146
epssPercentile: 0.03482
---

## Overview

The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hosted-payment return handler, allowing unauthenticated attackers to mark orders as paid without actually paying.

## Affected

- `gateway_for_vantiv_on_wc <= 1.0.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.