---
id: CVE-2026-94360
title: >-
  The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not
  verify the authenticity of an inbound payment notification before marking an
  order as paid, allowing unauthenticated attackers to mark orders as paid
  without a…
summary: >-
  The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not
  verify the authenticity of an inbound payment notification before marking an
  order as paid, allowing unauthenticated attackers to mark orders as paid
  without a…
severity: none
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T07:17:05.573'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94360'
references:
  - url: 'https://wpscan.com/vulnerability/f9ef7bfe-3e25-4edf-9c02-3fa9e2873e84/'
    label: contact@wpscan.com
tags:
  - nvd
ingestedAt: '2026-10-14T07:21:04.848Z'
---

## Overview

The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as paid, allowing unauthenticated attackers to mark orders as paid without any payment being completed.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.