HIGH 7.5 NVD

CVE-2026-10599

The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the order being marked as

The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the order being marked as paid, nor does it verify the authenticity of its payment-completion request, allowing unauthenticated attackers to reuse a single valid transaction to mark arbitrary orders as paid and bypass payment.

References

https://wpscan.com/vulnerability/a1aae05d-63d0-4cde-8a9c-996f58f58e48/

Published: 2026-08-06 · Source: NVD · Feed updated: 2026-08-07

This high severity vulnerability with a CVSS score of 7.5 was published on 2026-08-06 via NVD.

vulnfeed aggregates 9207 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.