CVE-2026-106014: Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback Forgery

Q: Who can exploit this issue?

An unauthenticated remote attacker can exploit it; no account, privileges, or user interaction are required.

Q: What is required for an attack to succeed?

The attacker needs to send a forged payment notification to the plugin's hosted-payment return handler. Because the handler does not verify notification authenticity, the attacker can cause an order to be marked as paid without making a payment.

Q: Which plugin versions are affected?

Gateway for Vantiv on WC versions through 1.0.1 are affected.

Q: What is the practical impact on an affected store?

Attackers may fraudulently complete orders by changing their payment status to paid, potentially allowing fulfillment without successful payment.

Published Oct 19, 2026

Updated

The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hosted-payment return handler, allowing unauthenticated attackers to mark orders as paid without actually paying.

Affected Software

1 affected component

Vantiv Gateway for Vantiv on WC<=1.0.1

Event History

Oct 19, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated remote attacker can exploit it; no account, privileges, or user interaction are required.

What is required for an attack to succeed?

The attacker needs to send a forged payment notification to the plugin's hosted-payment return handler. Because the handler does not verify notification authenticity, the attacker can cause an order to be marked as paid without making a payment.

Which plugin versions are affected?

Gateway for Vantiv on WC versions through 1.0.1 are affected.

What is the practical impact on an affected store?

Attackers may fraudulently complete orders by changing their payment status to paid, potentially allowing fulfillment without successful payment.

CVE-2026-106014: Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback Forgery

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is required for an attack to succeed?

Which plugin versions are affected?

What is the practical impact on an affected store?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is required for an attack to succeed?

Which plugin versions are affected?

What is the practical impact on an affected store?