PT-2026-134435

CVE-2026-94361

Published

2026-10-29

Updated

2026-11-03

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Payable Payment Gateway for WooCommerce WordPress plugin versions prior to 1.3.1

Description The plugin fails to verify the authenticity of incoming payment notifications before updating the status of a WooCommerce order to paid or failed. This allows unauthenticated attackers to modify the payment status of any order in the store, regardless of the payment method used.

Recommendations Update the plugin to version 1.3.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Claudio Marchesini

Dottor Marc

Enrico Marcolini

Vendors

Affected products

Weakness enumeration