Paymentfor Gateway CVE-2026-94360

Exploitation requires that the target WordPress site runs the Paymentfor Gateway for WooCommerce plugin at a version before 1.0.6 and offers this payment method at checkout; the attacker must be able to reach the plugin's inbound payment-notification (callback/IPN) endpoint and submit a notification referencing an existing order. No authentication, credentials, or user interaction are needed (PR:N/UI:N), and default configurations are affected because the plugin never validates notification authenticity. The main limiting factor is footprint: only stores that have installed and enabled this specific gateway are exploitable, so impact is confined to orders processed through the Paymentfor method.

This is a moderate, real-but-bounded risk rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) describes a network-reachable, low-complexity, unauthenticated flaw with only limited integrity impact and no confidentiality or availability loss - consistent with CWE-862 (missing authorization) on a payment-notification endpoint. Signals converge rather than conflict: EPSS is low (0.17%, 5th percentile) and the CISA SSVC framework records Exploitation=none, which agrees with the absence of any KEV listing, so there is no evidence of active in-the-wild exploitation. However, SSVC flags Automatable=yes and Technical Impact=partial, and a public exploit (WPScan) exists, so the barrier to abuse is low once an attacker targets an affected store. The practical significance is business/financial fraud: an attacker can mark WooCommerce orders as paid without paying, which maps to the single integrity impact (I:L) and explains why confidentiality and availability are rated None. Net: prioritize patching for any store actually running this plugin, but it is a fraud/integrity issue on a niche plugin, not a widespread RCE - the low EPSS and SSVC 'Exploitation: none' suggest opportunistic or targeted abuse rather than mass exploitation at this time.

An attacker places an order in a WooCommerce store using the Paymentfor gateway, then sends a forged payment-notification callback directly to the plugin's unauthenticated notification handler. Because the plugin does not verify the notification's authenticity, the order is marked as paid and fulfillment/shipping proceeds without any real payment. Publicly available exploit code (WPScan) lowers the effort required, and the low-complexity network vector means no user interaction or credentials are needed.