EUVD-2026-100880
GHSA-59h8-hqv9-9m63
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public payment-confirmation endpoint
-
DeliveryForge client-supplied payment parameters
-
ExploitSubmit unverified 'paid' confirmation
-
ExecutionMark record paid or destroy genuine records
-
ImpactFinancial loss and data tampering
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable only against sites running the CamPay Shortcode Payment Gateway plugin at a version before 1.7 with the Mobile Money payment flow in use. No authentication, user interaction, or special configuration is required (CVSS PR:N/UI:N) beyond the plugin processing payment confirmations - the vulnerable path trusts client-supplied confirmation parameters by default. The primary limiting factor is deployment scope: the plugin is a niche payment integration, so exposure is confined to the relatively small number of WordPress sites that have installed and activated it for live Mobile Money transactions. |
| Impact | This is a genuine but moderate-priority issue whose signals are largely consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, and CWE-862 (Missing Authorization) matches the description's core flaw: payment results are derived from client-supplied parameters with no server-side verification. Publicly available exploit code exists (WPScan), which raises practical risk, but this must NOT be conflated with active exploitation - SSVC lists Exploitation: none and the CVE is not in CISA KEV, so there is no evidence of in-the-wild abuse. The low EPSS score (0.17%, 5th percentile) aligns with the absence of KEV listing and the product's niche footprint, indicating opportunistic rather than widespread automated attack at present, even though SSVC rates the flaw Automatable: yes. Impact is bounded (Technical Impact: partial; CVSS C:N/I:L/A:N) - this is an integrity/business-logic problem (payment fraud and data tampering), not remote code execution or data disclosure. Net: a real priority for any site actually running this plugin for live payments, because forged 'paid' confirmations translate directly to financial loss, but not a broad-ecosystem emergency given low prevalence and no confirmed exploitation. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted request to the plugin's Mobile Money payment-confirmation endpoint with client-controlled parameters indicating a successful payment, causing the order/payment record to be marked as paid without any funds being transferred. The same unverified flow can be abused to delete legitimate payment records or write plugin meta onto arbitrary posts. Public exploit code is available via WPScan, lowering the skill barrier for abuse. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Unauthenticated attackers can forge Mobile Money payment confirmations against WordPress sites running the CamPay Shortcode Payment Gateway plugin before 1.7, marking fraudulent orders as paid, deleting genuine payment records, and writing plugin meta onto arbitrary posts. The root cause is a missing-authorization failure (CWE-862): the plugin's confirmation handling derives the payment outcome directly from client-supplied parameters rather than verifying authenticity with CamPay, so no login, user interaction, or non-default configuration is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Publicly available exploit code exists per WPScan, but observed exploitation is not recorded (EPSS 0.17%, 5th percentile; CISA SSVC exploitation: none), and the vendor has released a fix in version 1.7.
RemediationAI
Vendor-released patch: update CamPay Shortcode Payment Gateway to 1.7 or later - the fix is available from the vendor and is the only complete resolution for the missing confirmation-authenticity check. Until the upgrade can be staged, the practical compensating control is to deactivate the plugin entirely (trade-off: all CamPay checkout and shortcode rendering stops, so any live store must suspend or fall back to another payment method), or, if the plugin must stay active, disable the Mobile Money confirmation/shortcode flow and reconcile CamPay settlements manually against order records (trade-off: manual effort and delayed order fulfillment, but it removes the unauthenticated forgery path). Because the endpoint is unauthenticated (PR:N) and driven by client-supplied parameters, IP allowlisting or WAF rules are weak controls - CamPay's callback origins are not fixed in the available data, so blocking cannot be scoped reliably without breaking legitimate callbacks. After patching, audit wp_posts and postmeta for unexpected plugin meta written to arbitrary posts and reconcile payment/order records for unauthorized 'paid' states or deletions, since the flaw permits destructive modification of existing records. Reference advisory: https://wpscan.com/vulnerability/a5da90f5-563d-4397-b3bc-38bd1dc9aefb/ and https://nvd.nist.gov/vuln/detail/CVE-2026-105975.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a WordPress plugin that integrates the CamPay payment gateway, exposing payment functionality through a shortcode and handling Mobile Money payment confirmations. CWE-862 (Missing Authorization) is the assigned root-cause class: the confirmation routine accepts the payment result as a request parameter and never validates it against CamPay's server-side state, so any remote client can assert that a transaction succeeded. That breaks the integrity of the payment record (NVD scores I:L, C:N, A:N for a base of 5.3), while the independent assessment adds A:L because the same missing check lets an attacker destroy genuine payment records - an effect on record availability. No confidentiality impact is involved; the exploit does not disclose data, it falsifies and deletes it. The CPE entry (cpe:2.3:a:unknown:campay_shortcode_payment_gateway:*:*:*:*:*:*:*:*) reflects that the plugin's vendor identifier is not standardized in the NVD CPE dictionary, so matching should be done on plugin slug and WPScan/EUVD version data (CamPay Shortcode Payment Gateway 0 < 1.7, EUVD-2026-100880) rather than on CPE alone. SSVC classifies the issue as automatable with partial technical impact, consistent with a scriptable HTTP-level forgery that manipulates data but does not fully compromise the host.
Know when Campay Shortcode Payment Gateway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Remote, unauthenticated, low-complexity (AV:N/AC:L/PR:N); no data disclosure (C:N); limited integrity from forged payments/meta (I:L) and limited availability from destroying genuine payment records (A:L).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parameters, allowing unauthenticated attackers to mark payment records as paid, destroy genuine payment records, and write CamPay Shortcode Payment Gateway WordPress plugin before 1.7 meta onto arbitrary posts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB