CVE-2026-94360: Paymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card Callbacks
Published Oct 14, 2026
·Updated
The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as paid, allowing unauthenticated attackers to mark orders as paid without any payment being completed.
Affected Software
1 affected component
Paymentfor Gateway for WooCommerce<1.0.6
Event History
Oct 14, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated attacker can exploit it because inbound payment notifications are accepted without verifying their authenticity.
2
What is the practical impact on affected stores?
An attacker can cause an order to be marked as paid even though no payment was completed.
3
Which plugin versions are affected?
Paymentfor Gateway for WooCommerce versions before 1.0.6 are affected.