CVE-2026-82215

Name of the Vulnerable Software and Affected Versions Payment Gateway PayPay for WooCommerce WordPress plugin versions 0.5 through 0.9.3

Description The plugin fails to verify the authenticity of payment notifications before processing them. This allows unauthenticated attackers who possess the store's merchant identifier to manipulate order statuses, enabling them to mark arbitrary orders as paid, cancel them, or mark them as failed, effectively bypassing the payment process.

Recommendations Update the Payment Gateway PayPay for WooCommerce WordPress plugin to a version later than 0.9.3.