CVE-2026-91075: Medium severity vulnerability
The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark a pending order as paid without paying for it.
Event History
Frequently Asked Questions
Which sites are exposed to forged payment confirmations?
WordPress sites using the Eupago Gateway For Woocommerce plugin versions 4.5.0 through 4.7.5 may be exposed when configured in a way that does not verify the authenticity of incoming payment-confirmation webhooks.
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction. They need to send a forged payment-confirmation webhook request to cause a pending order to be marked as paid.
What is the impact of successful exploitation?
A successful attacker can change the status of a pending order to paid without making payment. The available information identifies integrity impact only; it does not indicate confidentiality or availability impact.