---
id: CVE-2026-94360
title: >-
  The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not
  verify the authenticity of an inbound payment notification before marking an
  order as paid, allowing unauthenticated attackers to mark orders as paid
  without a…
summary: >-
  The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not
  verify the authenticity of an inbound payment notification before marking an
  order as paid, allowing unauthenticated attackers to mark orders as paid
  without a…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-862
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T16:14:02.800'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94360'
references:
  - url: 'https://wpscan.com/vulnerability/f9ef7bfe-3e25-4edf-9c02-3fa9e2873e84/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-14T07:21:04.848Z'
product: Paymentfor Gateway for WooCommerce
affected:
  - paymentfor_gateway_for_woocommerce < 1.0.6
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-14T13:25:51.148676Z'
epss: 0.00239
epssPercentile: 0.14878
---

## Overview

The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as paid, allowing unauthenticated attackers to mark orders as paid without any payment being completed.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.