CVE-2026-94360: WooCommerce Payment Gateway Auth Bypass

CVE-2026-94360 Overview

The Paymentfor Gateway for WooCommerce WordPress plugin contains a missing authorization vulnerability [CWE-862] in versions prior to 1.0.6. The plugin fails to verify the authenticity of inbound payment notifications before marking an order as paid. Unauthenticated attackers can forge payment callbacks to flip order status to paid without transferring funds. The flaw affects merchants running the plugin on WooCommerce storefronts and directly enables fraudulent order fulfillment.

Critical Impact
Unauthenticated remote attackers can mark WooCommerce orders as paid without completing payment, enabling order fraud and financial loss for merchants.

Affected Products

Paymentfor Gateway for WooCommerce WordPress plugin versions before 1.0.6
WordPress sites using WooCommerce with the vulnerable plugin installed
E-commerce merchants accepting payments through the Paymentfor gateway integration

Discovery Timeline

2026-10-14 - CVE-2026-94360 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-94360

Vulnerability Analysis

The vulnerability resides in the payment notification handler of the Paymentfor Gateway for WooCommerce plugin. Payment gateways typically expose a callback endpoint that the payment processor invokes to confirm transaction status. Secure implementations validate these callbacks using signed tokens, HMAC signatures, or server-to-server verification against the payment provider's API.

The affected plugin accepts inbound notifications and updates the WooCommerce order status to paid without performing any authenticity check. An attacker who knows or guesses the order identifier can send a crafted HTTP request to the callback endpoint and trigger order completion. This exploitation requires no authentication, no user interaction, and only network access to the public WooCommerce storefront.

Root Cause

The root cause is a missing authorization check [CWE-862] on the payment notification endpoint. The plugin treats any inbound POST to the callback URL as a legitimate payment confirmation from the Paymentfor gateway. There is no signature validation, no shared-secret verification, and no out-of-band confirmation against the payment provider before the order status transitions to paid.

Attack Vector

Exploitation occurs over the network against the public WordPress site. An attacker places an order through normal checkout flow, captures the order identifier, then submits a forged notification request to the plugin's callback endpoint. The plugin accepts the request and marks the order as paid. The merchant's fulfillment workflow then ships goods or delivers digital assets without receiving funds. See the WPScan Vulnerability Advisory for technical details.

Detection Methods for CVE-2026-94360

Indicators of Compromise

Orders transitioning to paid status without a corresponding transaction record in the Paymentfor merchant dashboard
HTTP POST requests to the plugin's payment notification endpoint from IP addresses outside the Paymentfor provider's documented ranges
WooCommerce order notes referencing payment confirmation that lack a matching gateway transaction identifier

Detection Strategies

Reconcile WooCommerce order status against the Paymentfor merchant portal daily to identify orders marked paid without a matching settled transaction
Monitor web server access logs for unexpected POST requests to the plugin's callback URL and correlate source IPs against the official gateway provider
Alert on new paid orders that complete within unusually short intervals after creation or that originate from newly registered customer accounts

Monitoring Recommendations

Enable WooCommerce order audit logging and forward events to a centralized log platform for correlation
Track the ratio of paid-order volume to settled-funds volume and alert on divergence beyond a defined threshold
Review plugin and theme file integrity to detect unauthorized modifications introduced after a successful exploitation attempt

How to Mitigate CVE-2026-94360

Immediate Actions Required

Update the Paymentfor Gateway for WooCommerce plugin to version 1.0.6 or later immediately
Audit all orders marked as paid since the plugin was installed and reconcile against the Paymentfor merchant dashboard
Suspend fulfillment on any order where payment cannot be confirmed server-to-server with the gateway provider

Patch Information

Upgrade the Paymentfor Gateway for WooCommerce plugin to version 1.0.6 or later. Version 1.0.6 introduces authenticity verification on inbound payment notifications. Refer to the WPScan Vulnerability Advisory for advisory details and release notes.

Workarounds

Deactivate the Paymentfor Gateway for WooCommerce plugin until the patched version can be deployed
Restrict access to the plugin's payment callback endpoint using a web application firewall rule that allows only Paymentfor provider source IP ranges
Introduce a manual order review step before fulfillment to confirm each payment against the gateway merchant portal

bash

# Example WAF rule restricting access to the callback endpoint
# Replace <paymentfor-ip-range> with the provider's documented IPs
location ~ ^/\?wc-api=paymentfor_callback {
    allow <paymentfor-ip-range>;
    deny all;
}