CVE-2026-10599

Name of the Vulnerable Software and Affected Versions Integrate PhonePe with WooCommerce WordPress plugin versions prior to 1.2.2

Description The plugin fails to validate whether a verified payment transaction is associated with the specific order being marked as paid. Additionally, it does not verify the authenticity of payment-completion requests. This allows unauthenticated attackers to reuse a single valid transaction to mark arbitrary orders as paid, effectively bypassing the payment process.

Recommendations Update the plugin to version 1.2.2 or later.