UNKNOWN NVD

CVE-2026-94299

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification request

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where that secret has been left at its default empty value.

References

https://wpscan.com/vulnerability/7eb85c65-8dab-46e1-b1df-e5d966029b18/

Published: 2026-10-06 · Source: NVD · Feed updated: 2026-10-06

This unknown severity vulnerability was published on 2026-10-06 via NVD.

vulnfeed aggregates 11356 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.