Eupago Gateway For WooCommerce CVE-2026-91075

Exploitation requires the store to be running a vulnerable configuration in which the plugin does not verify the authenticity of incoming payment-confirmation webhooks - the description explicitly scopes this to 'some configurations,' so deployments that properly validate webhooks are not affected. The attacker needs a pending (unpaid) order and network access to the plugin's payment-confirmation webhook/callback endpoint; no authentication or user interaction is required (PR:N/UI:N). Limiting factors: impact is confined to marking orders as paid (integrity only - no data exposure or service disruption), and the non-default/conditional nature of the vulnerable webhook-verification setting constrains how many live installations are actually exploitable; the exact triggering configuration is not described in the available sources.

This is a moderate-severity business-logic / authentication flaw, not a memory-corruption or RCE issue. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) indicates a network-reachable, low-complexity, unauthenticated attack with limited integrity impact and no confidentiality or availability impact - consistent with the description that an attacker forges a payment-confirmation webhook to mark an order paid. The vuln.today Decision label is 'this_month' (a priority below act_now/emergency). No EPSS score and no KEV listing are present in the input, so there is no signal of active exploitation; exploitation status is best described as a public PoC reference existing but not verified as working exploit code. The one notable caveat is that the description limits the flaw to 'some configurations,' meaning the CVSS AC:L may understate real-world preconditions - the webhook-verification weakness is not necessarily present in every deployment. Net: a genuine fraud-enabling issue for affected stores warranting a scheduled fix within the month, but not an emergency given limited impact scope (integrity-only), niche product footprint, and no evidence of in-the-wild exploitation.

An attacker places an order in a WooCommerce store running the affected Eupago gateway, leaving it pending/unpaid, then sends a forged payment-confirmation webhook directly to the plugin's callback endpoint. Because the plugin does not verify the authenticity of the incoming webhook in the vulnerable configuration, the order is marked as paid and fulfilled without any actual payment. A public PoC reference exists (WPScan) but it is not verified as working exploit code.