Deema Payment Gateway EUVD-2026-92965

Exploitation requires only that the target WordPress site has the Deema Payment Gateway plugin (version ≤1.1.2) installed and active as a checkout option. The specific precondition is use of the plugin's hosted-checkout return handler, which accepts the buyer's return from the external checkout and marks the order paid WITHOUT calling back to the payment provider to confirm status or amount. No authentication, no user interaction, and no special non-default configuration are needed beyond having the gateway enabled; the limiting factors are therefore purely the plugin's presence and activation. Impact is bounded to order-state integrity (fraudulent 'paid' orders) rather than data disclosure or site availability.

This is a payment-verification/business-logic flaw (CWE-287) in the Deema Payment Gateway WordPress plugin, scored CVSS 5.3 (MEDIUM) by the reporter. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N indicates remote, unauthenticated, low-complexity exploitation with no user interaction and a low integrity impact only - no confidentiality or availability loss. Signals are moderately consistent: WPScan reports publicly available exploit code exists, which raises practical risk above the raw medium score, but there is NO CISA KEV listing and NO EPSS score supplied in the input, so there is no evidence of widespread or automated exploitation at this time. The real-world severity is better captured as a direct financial-fraud risk to merchants (orders fulfilled without payment) than as a classic data-breach - the CVSS I:L arguably understates business impact for a merchant but is technically correct for data-integrity scope. Net: a credible, easy-to-exploit issue worth prompt patching for any site actually running this plugin, but not an emergency across the broader ecosystem given the plugin's narrow footprint and absence of KEV/EPSS evidence. Missing data to note explicitly: no EPSS probability and no KEV status were provided, so likelihood-of-exploitation cannot be quantified from the input.

An attacker places an order on a WordPress store using the Deema Payment Gateway, proceeds to the hosted checkout, and then simply triggers the return-to-site callback (or replays/forges it) without ever completing a real payment. Because the plugin does not verify the transaction with the payment provider or check status/amount, the order is marked paid and fulfilled. Public exploit code for this flow exists (WPScan), and the CVSS AV:N/AC:L/PR:N/UI:N vector means it is a low-effort, unauthenticated remote action.