CVE-2026-88928: PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification Bypass
The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwrite the stored payment token associated with existing orders and delete saved card records.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
PAYCOMET for WooCommerce versions before 5.46 are affected. The reported affected range is 5.36 through 5.45.
What does an attacker need to exploit this issue?
An attacker can exploit the payment notification endpoint without authentication when submitting a request that references a tokenisation operation. The endpoint does not verify the cryptographic signature in that case.
What could an attacker change?
An attacker can overwrite the stored payment token associated with existing orders and delete saved card records.
What should be done if patching cannot happen immediately?
The available information identifies the affected payment notification endpoint and tokenisation-operation requests, but does not provide a documented workaround or mitigation other than upgrading to version 5.46 or later.