Gateway for Vantiv CVE-2026-106014

Exploitation requires the target site to be running the 'Gateway for Vantiv on WC' WooCommerce plugin (version ≤1.0.1) and to process payments through its hosted-payment return flow; the attacker must be able to reach the plugin's hosted-payment return handler endpoint and submit a request during/after an order. No authentication, no user interaction, and no non-default configuration are needed - the handler accepts return notifications without verifying their authenticity (CWE-284). The practical limiting factors are narrow: the specific plugin must be installed and actively used as the store's payment gateway, which given the product's niche nature sharply constrains the exposed population; there is no impact on sites not using this plugin or not relying on its hosted-payment return handling.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) describes a remotely reachable, low-complexity, unauthenticated flaw with no user interaction, but the impact is deliberately scoped to integrity-only and rated Low (C:N/I:L/A:N) - there is no system compromise, data disclosure, or availability loss. The real-world consequence is financial/business-logic fraud: an attacker forges a payment-return notification to mark WooCommerce orders as paid without paying. Publicly available exploit code exists (reported by WPScan), which raises practical exploitability, but no EPSS score was provided in the input and the CVE is NOT listed in CISA KEV, so there is no evidence of active, widespread exploitation. This is best treated as a moderate, merchant-specific priority rather than a critical infrastructure threat: the medium severity is driven by trivial exploitability against a payment flow, while the limited scope and the apparently niche affected product cap the aggregate risk. Note the signals are consistent (no conflict between vector and description); the main missing data points are EPSS probability and any vendor/patch advisory confirming a fixed version.

An attacker places an order in a WooCommerce store running this plugin, then sends a crafted HTTP request to the plugin's hosted-payment return handler mimicking a successful Vantiv payment notification, which the plugin accepts without validating authenticity. The order is marked paid and fulfillment/shipment proceeds even though no payment occurred. Public exploit code for this technique is available via WPScan, lowering the skill required.