MEDIUM 5.3 NVD

CVE-2026-84091

The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before

The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment.

References

https://wpscan.com/vulnerability/10c7a9bd-eac0-49eb-9238-d7c477312166/

Published: 2026-09-23 · Source: NVD · Feed updated: 2026-09-23

This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-09-23 via NVD.

vulnfeed aggregates 12912 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.