CVE-2026-87841: UnitechPay <= 1.0.6.3 - Unauthenticated Order Payment Bypass via Unsigned Webhook
Published Oct 9, 2026
·Updated
The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receives, allowing unauthenticated attackers to mark orders placed through it as paid without any payment being made, as well as to force other orders into a failed state.
Affected Software
1 affected component
UnitechPay UnitechPay WordPress plugin<=1.0.6.3
Event History
Oct 9, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated attacker can exploit it because the plugin does not verify the authenticity of payment notifications. No legitimate payment is required to mark affected orders as paid or force other orders into a failed state.
2
Which installations are affected?
The issue affects the UnitechPay WordPress plugin through version 1.0.6.3. The provided information does not identify any configuration requirement or mitigation other than updating beyond the affected versions.