Payable Payment Gateway CVE-2026-94361

No authentication or user interaction is required: the plugin before version 1.3.1 fails to verify the authenticity of incoming payment notifications before marking a WooCommerce order paid or failed, so an unauthenticated remote attacker can POST a forged notification to the publicly reachable callback endpoint and change the payment status of any order regardless of the payment method used. Limiting factors: the vulnerable plugin (versions below 1.3.1) must be installed and active on a WooCommerce store, and the attacker needs a valid target order reference (order IDs are sequential and often guessable/enumerable). Impact is confined to order payment status (integrity) - no customer data is disclosed and site availability is unaffected.

This is a genuine but moderate-priority issue rather than a critical one. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) indicates remote, low-complexity, unauthenticated exploitation with impact confined to integrity (I:L) and no confidentiality or availability impact - consistent with the described flaw: a missing authenticity check (CWE-862) on incoming payment notifications lets anyone flip an order's paid/failed status. The signals are internally consistent and point to limited severity: EPSS is low (0.15%, 4th percentile), the vulnerability is NOT in CISA KEV, SSVC reports Exploitation: none with Technical Impact: partial, and no verified exploit code is present in the input. The one amplifying signal is SSVC Automatable: yes - abuse can be scripted against the public notification endpoint - which aligns with the vendor/vuln.today 'this_month' priority rather than an emergency. The real-world risk is financial fraud (marking unpaid orders as paid, or sabotaging legitimate orders by marking them failed) scoped to stores running this specific plugin, not system compromise. Note the low EPSS and 'Exploitation: none' indicate no observed exploitation despite the easy attack preconditions, suggesting the limited install base and merchant-specific payoff keep it off commodity attack lists.

An attacker targeting an online store running the vulnerable plugin sends a forged payment notification to the plugin's public callback endpoint, specifying a target order. Because the plugin does not verify the notification's authenticity, the order is marked paid and the merchant ships goods for which no payment was received; conversely an attacker could mark legitimate orders as failed to disrupt the business. No verified public exploit code is present in the provided data, but the attack requires no authentication and only low complexity.