Deema Payment Gateway CVE-2026-94270

The decisive prerequisite is explicitly stated in the description: the plugin does not verify the authenticity of incoming payment-provider notifications AND ships with that verification disabled by default, so a default installation of the Deema Payment Gateway plugin (versions through 1.1.2) is directly exploitable. The target must be a WordPress site with this plugin installed and active and have a reachable payment-notification/callback endpoint. The primary limiting factor is that the impact is confined to order-state manipulation (mark-as-paid, cancel, refund) - there is no server compromise, data disclosure, or availability loss; a site operator who has manually enabled notification signature verification (non-default) would not be exploitable.

This is a genuine but moderate-priority issue rather than a critical emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:N) correctly reflects that a remote, unauthenticated attacker can trigger the flaw with low complexity and no user interaction, because the plugin ships with notification authenticity verification disabled by default - so exploitation targets default configurations. However, impact is bounded: the CVSS records only C:N/I:L/A:N (limited integrity, no confidentiality or availability loss), consistent with the SSVC 'Technical Impact: partial' rating. SSVC also reports 'Exploitation: none' (no confirmed in-the-wild activity) but 'Automatable: yes', meaning that while there is no evidence of active exploitation, the attack is trivially scriptable against many sites. Publicly available exploit code exists (WPScan), which raises practical risk, but this must not be conflated with active exploitation - no CISA KEV listing is present and no EPSS score was provided in the input, so the empirical exploitation probability cannot be stated. The real-world severity is driven by business/financial fraud (marking unpaid orders as paid, forcing refunds/cancellations) rather than server compromise; the CVSS 5.3 arguably understates financial impact for e-commerce operators while correctly capturing the limited technical footprint. Net: patch promptly on affected stores, but this is not a remote-code-execution-class crisis.

An attacker identifies a WooCommerce/WordPress store running the Deema Payment Gateway plugin (≤1.1.2) and sends a forged payment-provider notification (e.g. an IPN/callback POST) directly to the plugin's notification endpoint. Because the plugin does not verify the notification's authenticity and signature verification is off by default, the forged message is accepted and the attacker marks their own unpaid order as 'paid' - obtaining goods without payment - or cancels/refunds a legitimate order. A public proof-of-concept exists via WPScan, and the attack is network-based and low-complexity with no authentication or user interaction required.