CVE-2026-94299

Name of the Vulnerable Software and Affected Versions elegro Crypto Payment versions prior to 1.0.2

Description The plugin fails to require a shared secret before trusting incoming payment notification requests. This allows unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on installations where the secret remains at its default empty value.

Recommendations Update the plugin to a version newer than 1.0.1. Configure a strong shared secret for payment notification requests to prevent the forging of payment confirmations.