SUMIT Payment Gateway CVE-2026-111957

Requires a WordPress site running the SUMIT Payment Gateway for WooCommerce plugin at a version before 4.0.0 with the SUMIT gateway enabled and at least one pending order present. The attacker must first obtain a valid payment identifier from any single genuine SUMIT payment (easily self-generated via a legitimate low-value purchase), then replay it against the confirmation flow. No authentication, no privileges, and no victim interaction are required (PR:N/UI:N). The practical limiting factor is the narrow deployment of this specific gateway plugin and the need to possess one real payment identifier, not any access control.

This is a CWE-863 broken-authorization / payment-logic flaw rated CVSS 5.3 (Medium). The provided vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N is internally consistent with the description: network-reachable, low complexity, no privileges, no user interaction, with impact limited to integrity (C:N/A:N, I:L) - the attacker can falsely flip an order's state to 'paid' but cannot read data or degrade availability. Exploitation signals: publicly available exploit code exists (reported by WPScan), but there is NO CISA KEV listing and NO EPSS score was supplied, so widespread automated exploitation cannot be confirmed from the data - the risk is best characterized as opportunistic fraud against a specific plugin rather than mass exploitation. No SSVC decision data was provided. The real-world priority is driven less by the modest 5.3 score and more by the direct financial-fraud outcome (obtaining goods/services without paying), which matters acutely to any merchant running this gateway; for everyone else the narrow deployment footprint keeps aggregate risk low. The CVSS vector and the description align with no major conflict.

An attacker places a small legitimate order through a store using the SUMIT gateway and captures the payment identifier returned by the provider. They then create a new, higher-value pending order and replay that same captured identifier to the confirmation endpoint; because the plugin does not bind the confirmation to the specific order or validate the amount, the second order is marked paid and fulfilled without payment. A public exploit is available via WPScan, and no authentication or user interaction is required.