CVE-2026-105975: CamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forgery via external_reference
The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parameters, allowing unauthenticated attackers to mark payment records as paid, destroy genuine payment records, and write CamPay Shortcode Payment Gateway WordPress plugin before 1.7 meta onto arbitrary posts.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker does not need to authenticate. The vulnerable plugin accepts client-supplied payment confirmation parameters without verifying that the Mobile Money confirmation is authentic.
What can an attacker do if exploitation succeeds?
An attacker can mark payment records as paid, destroy legitimate payment records, and write plugin metadata to arbitrary WordPress posts.
Which installations are affected?
CamPay Shortcode Payment Gateway versions before 1.7 are affected. The provided information does not identify any configuration prerequisite.
How can I determine whether payment records may have been manipulated?
Review payment records for unexpected paid statuses, missing or destroyed genuine payment records, and CamPay Shortcode Payment Gateway metadata attached to posts where it does not belong.