CVE-2026-96173: Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR

Q: Who is exposed to this issue?

Sites using Payments for Hubtel versions earlier than 1.0.2 are affected. The exposed functionality is a public payment-callback request, so exploitation does not require an authenticated WordPress account.

Q: What does an attacker need to exploit it?

An attacker can exploit the issue remotely with no privileges or user interaction. They must target an order identifier in the vulnerable callback flow to obtain that order's key and view its contents.

Q: What should be done to remediate the issue?

Update Payments for Hubtel to version 1.0.2 or later. The issue affects versions before 1.0.2.

Published Oct 1, 2026

Updated

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents.

Affected Software

1 affected component

Hubtel Payments for Hubtel<1.0.2

Event History

Oct 1, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Sites using Payments for Hubtel versions earlier than 1.0.2 are affected. The exposed functionality is a public payment-callback request, so exploitation does not require an authenticated WordPress account.

What does an attacker need to exploit it?

An attacker can exploit the issue remotely with no privileges or user interaction. They must target an order identifier in the vulnerable callback flow to obtain that order's key and view its contents.

What should be done to remediate the issue?