CVE-2026-84043: ePayco Payment Gateway for WooCommerce < 8.4.7 - Unauthenticated Payment Confirmation Bypass
Published Sep 4, 2026
·Updated
The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signature.
Affected Software
1 affected component
ePayco ePayco Payment Gateway for WooCommerce<8.4.7
Event History
Sep 4, 2026
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
WordPress sites using the ePayco Payment Gateway for WooCommerce plugin at a version earlier than 8.4.7 are exposed.
2
What does an attacker need to exploit it?
An attacker can exploit the issue remotely without authentication, user interaction, or a valid payment gateway signature.
3
What is the practical impact of successful exploitation?
An attacker may be able to cause WooCommerce orders to be marked as paid even when no valid payment confirmation was provided.
4
How can I tell whether my site is affected?
Check whether the ePayco Payment Gateway for WooCommerce plugin is installed and whether its version is earlier than 8.4.7.