CVE-2026-111957: SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via Redirect Callback
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being completed, nor check the payment amount against the order total, allowing unauthenticated users to mark a pending order as paid by replaying a payment identifier obtained from any single genuine payment.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Stores using SUMIT Payment Gateway for WooCommerce versions before 4.0.0 are affected when they have pending orders that can be completed through the plugin's payment confirmation redirect callback.
What does an attacker need to exploit this issue?
The attacker needs a payment identifier from any one legitimate payment. They can replay that identifier to mark a pending order as paid without authentication.
Does the forged payment need to match the target order's value?
No. The plugin does not verify that the confirmed payment is bound to the order being completed or that its amount matches the order total.
What should be done if upgrading cannot happen immediately?
Manually review pending orders marked as paid through the SUMIT payment confirmation flow, especially where the payment identifier or amount does not correspond to the completed order.