Chikkili Google Pay CVE-2026-94295

Exploitation requires a target WordPress site running the Chikkili- Google Pay India for Woocommerce plugin at version ≤1.0.6 with WooCommerce and this Google Pay India payment method installed and enabled; the attacker reaches the plugin's payment-notification/callback endpoint, which fails to verify that the notification originated from the payment provider (CWE-862). Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is needed. Limiting factors: the flaw is confined to stores that have specifically installed and activated this plugin, and impact is restricted to fraudulently marking orders as paid (integrity) - there is no confidentiality or availability impact and no remote code execution.

Signals are mostly consistent and point to a genuine but moderate-severity business-logic flaw rather than a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw with no user interaction, but impact is constrained to integrity only (C:N/I:L/A:N), yielding a base score of 5.3 - there is no code execution, data disclosure, or availability loss. EPSS is very low at 0.14% (3rd percentile), the CVE is NOT in CISA KEV, and the exploit signal is a WPScan reference only, not verified working exploit code, so active exploitation is not demonstrated. The vuln.today decision label is 'this_month', which aligns with the picture: a real authorization-check gap worth patching on a normal maintenance cycle rather than an act_now/emergency item. The main caveat is business risk versus technical severity - for a merchant, 'mark arbitrary orders as paid without payment' is directly monetizable fraud, so real-world impact to an affected shop can exceed what a 5.3 implies even though the technical impact metric is only I:L.

An attacker identifies a WooCommerce store running this plugin (≤1.0.6) with the Google Pay India payment method enabled, then sends a forged payment-notification request to the plugin's callback endpoint, which does not verify the notification actually came from the payment provider. The store marks the attacker's order as paid and may release digital goods or begin fulfillment without any real payment. A public PoC reference exists on WPScan; it is not verified as working exploit code.