CVE-2026-94271: Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return
The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being taken.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker does not need to authenticate. They can exploit the plugin's handling of the return from hosted checkout to cause orders to be marked as paid without a payment being taken.
Which deployments are affected?
Deema Payment Gateway for WordPress is affected through version 1.1.2. The issue is in the payment-return handling flow; the provided data does not identify any configuration prerequisite.
How can I determine whether an order may have been fraudulently confirmed?
Review orders marked paid and compare them with the payment provider's records. Affected orders may be marked paid even though no corresponding payment was taken.