{"id":"CVE-2026-94361","aliases":[],"cve":{"records":[{"id":"CVE-2026-94361","source":"WPScan","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-21T10:09:30.244Z","published":"2026-10-31T06:00:23.604Z","modified":"2026-11-01T17:34:16.609Z"}],"publishers":[{"name":"WPScan","role":"CNA","organizationId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","modified":"2026-10-31T06:00:23.604Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-01T17:34:16.609Z"}],"references":[{"url":"https://wpscan.com/vulnerability/1c6a831e-2d14-4c73-8a9e-d28d9262f626/","tags":["exploit","vdb-entry","technical-description"],"source":"WPScan"}],"weaknesses":[{"id":"CWE-862","description":"CWE-862 Missing Authorization","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-01T17:26:40.490559Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned Callback","titleSource":"WPScan","descriptionSource":"WPScan","description":"The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed, allowing unauthenticated attackers to change the payment status of any order in the store regardless of the payment method it was placed with.","score":5.3,"severity":"medium","published":"2026-10-31T06:00:23.604Z","modified":"2026-11-01T17:34:16.609Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Unknown","name":"Payable Payment Gateway for WooCommerce","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"1.3.1","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"WPScan","url":"https://www.cve.org/CVERecord?id=CVE-2026-94361"}],"remediation":[],"references":["https://wpscan.com/vulnerability/1c6a831e-2d14-4c73-8a9e-d28d9262f626/"],"sources":[{"name":"CVE","id":"CVE-2026-94361","modified":"2026-11-01T17:34:16.609Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-94361"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3}],"sourceAffected":[],"observedAt":"2026-11-01T17:49:14.577Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:25:34.584Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-31T06:30:31.741Z","attemptedAt":"2026-10-31T06:30:31.741Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-31T06:30:31.443Z","attemptedAt":"2026-10-31T06:30:31.443Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-10-31T06:30:31.433Z","attemptedAt":"2026-10-31T06:30:31.433Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-31T06:30:31.443Z","attemptedAt":"2026-10-31T06:30:31.443Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-94361","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94361","modified":"2026-10-31T06:16:35.460","checkedAt":"2026-10-31T06:30:31.741Z"}],"aiSummary":{"text":"The Payable Payment Gateway for WooCommerce plugin before 1.3.1 is vulnerable to unauthenticated order payment forgery, allowing attackers to change the payment status of any order. The plugin does not verify the authenticity of incoming payment notifications. This is due to missing authorization.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-01T19:36:05.095Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-94361"}]}}