Trust Payments Gateway CVE-2026-87843

Exploitation requires that the store runs the Trust Payments Gateway for WooCommerce plugin at a version before 3.1.0 and uses its hosted (off-site) payment page flow, where the customer returns to the store via a provider callback. The specific defect is that this return/callback handler does not verify the payment provider's response signature/authenticity, does not bind the response to the targeted order, and does not validate the paid amount - so an unauthenticated attacker only needs to reach the public return endpoint and submit a forged success response referencing a chosen order. Consistent with AV:N/AC:L/PR:N/UI:N, there is no authentication, no victim interaction, and no special non-default configuration required beyond using the plugin's normal hosted-payment mode; the main limiting factor is simply that the affected plugin and its Trust Payments integration must be installed and in use.

This is a genuine but moderate-priority issue whose business impact exceeds what the raw CVSS 6.5 (Medium) suggests. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N confirms remote, low-complexity, unauthenticated exploitation with no user interaction - a cleanly exploitable precondition set. The signals mostly agree in direction but diverge on urgency: SSVC marks Exploitation as 'none' (no observed active exploitation) yet Automatable as 'yes' with Technical Impact 'partial', and a public exploit exists (WPScan), so the barrier to weaponization is low even though the EPSS probability is only 0.17% (5th percentile). This EPSS/POC tension is typical of a niche plugin - the capability is public and trivial to automate, but the small install base keeps observed exploitation volume low, so EPSS has little historical signal. It is NOT on CISA KEV, so there is no confirmed active exploitation. The headline consideration is that CVSS I:L understates the real-world consequence: an attacker can mark arbitrary orders as paid without payment, which is direct financial fraud / revenue loss for merchants rather than a minor integrity dent. Net: treat as a real priority for any merchant running this specific plugin (patch to 3.1.0), but not a mass-exploitation emergency across the broader estate.

An attacker places an order on a WooCommerce store using the Trust Payments gateway, then directly crafts and sends the 'return from hosted payment page' callback to the store without actually paying, since the plugin never verifies the provider's response authenticity, binds it to the order, or checks the amount. The store marks the order as paid and may ship goods or grant services for free; the same unauthenticated flow also exposes order and customer details. A public exploit is available from WPScan, lowering the skill required to reproduce this.