CVE-2026-94295
Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forgery via Unverified Signature
Fetching some sources has been requested. Reload in about a minute to see them.
CVSS v3.1 (listed by NVD)
—
Not scored
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
—
Not scored
EPSS exploit probability
—
Not computed
CISA KEV
—
Not listed
Description
CNA (WPScan)
The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before marking the associated order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made.
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Chikkili- Google Pay India for Woocommerce | affected: 0 … <= 1.0.6 default: unknown |
Linux distribution status
References (1)
- https://wpscan.com/vulnerability/d6ee17a1-0db1-4610-8c96-96e98fb734ec/ CNA exploitvdb-entrytechnical-description