CamPay Payment Gateway CVE-2026-105975

Exploitable only against sites running the CamPay Shortcode Payment Gateway plugin at a version before 1.7 with the Mobile Money payment flow in use. No authentication, user interaction, or special configuration is required (CVSS PR:N/UI:N) beyond the plugin processing payment confirmations - the vulnerable path trusts client-supplied confirmation parameters by default. The primary limiting factor is deployment scope: the plugin is a niche payment integration, so exposure is confined to the relatively small number of WordPress sites that have installed and activated it for live Mobile Money transactions.

This is a genuine but moderate-priority issue whose signals are largely consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, and CWE-862 (Missing Authorization) matches the description's core flaw: payment results are derived from client-supplied parameters with no server-side verification. Publicly available exploit code exists (WPScan), which raises practical risk, but this must NOT be conflated with active exploitation - SSVC lists Exploitation: none and the CVE is not in CISA KEV, so there is no evidence of in-the-wild abuse. The low EPSS score (0.17%, 5th percentile) aligns with the absence of KEV listing and the product's niche footprint, indicating opportunistic rather than widespread automated attack at present, even though SSVC rates the flaw Automatable: yes. Impact is bounded (Technical Impact: partial; CVSS C:N/I:L/A:N) - this is an integrity/business-logic problem (payment fraud and data tampering), not remote code execution or data disclosure. Net: a real priority for any site actually running this plugin for live payments, because forged 'paid' confirmations translate directly to financial loss, but not a broad-ecosystem emergency given low prevalence and no confirmed exploitation.

An unauthenticated attacker sends a crafted request to the plugin's Mobile Money payment-confirmation endpoint with client-controlled parameters indicating a successful payment, causing the order/payment record to be marked as paid without any funds being transferred. The same unverified flow can be abused to delete legitimate payment records or write plugin meta onto arbitrary posts. Public exploit code is available via WPScan, lowering the skill barrier for abuse.