Payments for Hubtel CVE-2026-96200

Requires the target WordPress site to have the Payments for Hubtel plugin (before 1.0.2) installed and active with its payment callback/notification (IPN) endpoint network-reachable, which it is by design since the legitimate provider must call it. The attacker needs a valid or guessable target order ID to mark as paid. No authentication, credentials, or user interaction are required (PR:N/UI:N), and default configurations are vulnerable because the plugin omits any origin/signature verification on inbound callbacks. The main limiting factor is the plugin's niche deployment and the attacker's ability to reference a specific pending order; no non-default setting is needed to exploit.

This is a genuine but moderate-severity integrity flaw, not a high-urgency crisis. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) is internally consistent with the description: an unauthenticated, network-reachable, low-complexity attack with no user interaction that affects integrity only (orders marked paid) with no confidentiality or availability impact. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - this is targeted-abuse/fraud material rather than mass-automated exploitation. The CWE-862 (missing authorization) classification is accurate and more precise than the 'Authentication Bypass' tag applied in the metadata, which mischaracterizes a missing callback-origin verification as an authentication bypass. The real-world risk is concentrated: any site running this specific gateway is directly exposed to payment fraud (obtaining goods/services without paying), but the plugin's niche footprint limits aggregate impact. No conflicting signals between CVSS and description were found; the primary caveat is that the exact callback endpoint and order-ID enumeration requirements are not detailed in the advisory.

An attacker who identifies a store running the Payments for Hubtel plugin crafts a forged HTTP payment-notification request to the plugin's public callback/IPN endpoint, impersonating a 'payment successful' message from Hubtel for a target order ID. Because the plugin does not validate that the callback genuinely originated from Hubtel (no signature/secret/source verification), the order is transitioned to 'paid' and fulfillment proceeds without any real payment. No authentication, user interaction, or special privileges are required; no public POC is noted in the provided data.