CVE-2026-96200: Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Payment Callback
Published Oct 1, 2026
·Updated
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment.
Affected Software
1 affected component
Hubtel Payments for Hubtel<1.0.2
Event History
Oct 1, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
An attacker only needs to send a forged payment notification to the plugin's payment callback. The callback does not verify that the notification originated from the payment provider.
2
Which orders can be affected?
An unauthenticated attacker can mark arbitrary orders as paid without making a payment.
3
What versions are affected?
Versions of the Payments for Hubtel WordPress plugin before 1.0.2 are affected.