{"id":"CVE-2026-88928","title":"PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification Bypass","summary":"The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwr…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvssSource":"adp","cwe":["CWE-287"],"product":"PAYCOMET for WooCommerce","affected":["paycomet_for_woocommerce >= 5.36 < 5.46"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-29T10:52:19.236626Z"},"published":"2026-10-29","updated":"2026-10-29","sourceUpdated":"2026-10-29T10:56:08.430Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-88928","references":[{"url":"https://wpscan.com/vulnerability/aa7b4a44-9584-47e5-b3a1-1dcf876a86e4/"}],"tags":["cve.org"],"epss":0.00164,"epssPercentile":0.05691,"ingestedAt":"2026-11-01T17:57:46.223Z","slug":"CVE-2026-88928","body":"## Overview\n\nThe PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwrite the stored payment token associated with existing orders and delete saved card records.\n\n## Affected\n\n- `paycomet_for_woocommerce >= 5.36 < 5.46`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}