CVE-2026-84091: SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via bit IPN
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites using SUMIT Payment Gateway for WooCommerce versions earlier than 4.0.0 are affected. An attacker does not need authentication to target a pending order.
What does an attacker need to do to exploit it?
The attacker needs to send a forged payment notification for a corresponding pending order. Because the plugin does not verify the notification with the payment provider, the order can be marked as paid without a completed payment.
What is the practical impact?
An attacker may cause a pending WooCommerce order to be treated as paid even though no payment was completed. The provided severity vector indicates integrity impact only, with no stated confidentiality or availability impact.