EUVD-2026-95505
GHSA-wvj2-mvv8-vc7f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site using UnitechPay plugin
-
DeliveryPlace order to obtain order reference
-
ExploitSend forged payment notification to callback
-
ExecutionOrder marked paid without payment
-
ImpactFraudulent fulfillment or forced order failure
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target WordPress site has the UnitechPay plugin (version ≤1.0.6.3) installed and active and uses it to process orders; the attacker sends a payment-notification/callback to the plugin's handler, which does not verify the notification's authenticity (no signature/secret validation), so no credentials, account, or user interaction are needed against a default install. The practical limiting factors are product-specific rather than configuration-specific: the site must actually run this plugin and expose its payment-callback endpoint, and impact is confined to order payment status (marking orders paid or forcing them to failed) with no code execution or data disclosure. |
| Impact | Signals are consistent and point to a moderate, not critical, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) correctly reflects a remotely reachable, low-complexity, unauthenticated flaw, but the 5.3 Medium score is driven entirely by a limited integrity impact (C:N/I:L/A:N) - there is no data disclosure and no service outage, only unauthorized manipulation of order payment state. EPSS is low at 0.14% (3rd percentile), and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation; however, publicly available exploit code exists (WPScan), which raises the practical likelihood of opportunistic abuse against exposed installs. The net picture is a genuine but bounded business-logic/fraud risk rather than a server-compromise emergency: low EPSS plus POC-but-no-KEV suggests the flaw is weaponizable but not yet widely exploited, and its real impact is financial (fraudulent order fulfillment) concentrated on the subset of sites running this specific commerce plugin. No key signals conflict with the description; the main limiting factor is the narrow deployment footprint of the affected product. |
| Exploit ScenarioDerived | An unauthenticated attacker places an order through a store using the UnitechPay plugin, then sends a forged payment-notification (IPN-style) callback to the plugin's unauthenticated endpoint, which fails to verify authenticity and marks the order as paid without any real payment - enabling fraudulent fulfillment of goods. The same unverified mechanism can be abused to force arbitrary legitimate orders into a failed state, disrupting other customers' transactions. Publicly available exploit code (WPScan) lowers the barrier, and the AV:N/AC:L/PR:N/UI:N vector means no authentication or user interaction is needed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Unauthenticated payment-status forgery in the UnitechPay WordPress plugin (through version 1.0.6.3) allows remote attackers to mark orders as paid without any payment being made and to force other orders into a failed state. The plugin's payment-notification handler consumes incoming notifications without verifying their authenticity, so a forged callback reaches the affected site with no credentials and no user interaction (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N, integrity-only impact of C:N/I:L/A:N, CWE-862). Publicly available exploit code exists, but the issue is not listed as confirmed actively exploited (CISA KEV) and EPSS is low at 0.14% (3rd percentile), so the signals are consistent and point to a moderate, not critical, priority for sites that actually run and rely on this plugin for checkout.
RemediationAI
No vendor-released patch is identified in the available data, and no fixed version number should be assumed, so the immediate step is to check the plugin's update channel (and its WordPress.org or vendor listing) for a release above 1.0.6.3 and apply it as soon as one appears. Until then, the most reliable mitigation is to deactivate and remove UnitechPay if the site can tolerate losing its payment-processing integration, accepting the obvious trade-off that checkout via this plugin stops working; if payment processing must continue, restrict the plugin's notification/callback endpoint at the web server or WAF so that only the payment provider's documented source addresses may POST to it, with the caveat that provider ranges can change or be shared infrastructure and that a mismatch silently breaks legitimate order updates. Additional compensating controls include monitoring and auditing order-status transitions for unexpected jumps to 'paid' or 'failed', reviewing order fulfilment against settlement reports from the payment provider before shipping, logging and alerting on all requests to the plugin's callback route, and manually confirming high-value order payments. Per WPScan (https://wpscan.com/vulnerability/f04babb4-2dee-4c41-8b4c-0c2428009180/) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-87841), the exposure is limited to order payment status, so reconciliation and fulfilment holds remain effective compensating measures while a patch is pending.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-862 (Missing Authorization): the plugin implements a payment-notification endpoint - the callback/webhook style interface by which a payment provider informs the shop that a transaction succeeded or failed - but does not validate the authenticity of the incoming request, meaning no shared secret, HMAC signature, or provider-issued token is checked before the order status is updated. In WordPress plugin architecture such handlers are commonly exposed through admin-ajax.php actions or REST routes whose permission callback effectively permits anonymous access, so the failure surfaces as an absent cryptographic verification step rather than a role-based access check. Because no signature validation occurs, the integrity of the order record is fully attacker-controlled: the request payload alone determines whether an arbitrary order becomes 'paid' or 'failed'. The supplied CPE, cpe:2.3:a:unknown:unitechpay:*:*:*:*:*:*:*:*, lists the vendor as unknown and the version as a wildcard, reflecting incomplete normalization of the plugin's distribution metadata, while the EUVD entry records the concrete affected range as UnitechPay 0 through 1.0.6.3; the CVSS vector's network vector, PR:N, and UI:N confirm the handler is reachable without authentication or user interaction, and S:U with C:N/A:N confirms the impact is confined to order-state integrity with no code execution, privilege escalation, or data disclosure.
Know when Unitechpay gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated remote callback with no interaction gives AV:N/AC:L/PR:N/UI:N; impact is limited order-state tampering, so I:L with C:N and A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receives, allowing unauthenticated attackers to mark orders placed through it as paid without any payment being made, as well as to force other orders into a failed state.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB