PT-2026-122953

CVE-2026-94295

Published

2026-10-25

Updated

2026-10-29

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Chikkili- Google Pay India for Woocommerce WordPress plugin versions prior to 1.0.7

Description An issue exists where the plugin fails to verify that payment notifications originate from the legitimate payment provider before marking an order as paid. This allows unauthenticated attackers to mark arbitrary orders as paid without completing any actual payment.

Recommendations Update Chikkili- Google Pay India for Woocommerce WordPress plugin to version 1.0.7 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Pedro Pinho

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers