CVE-2026-94295

Published Oct 25, 2026

Last updated a day ago

Overview

Description
The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before marking the associated order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made.
Source
contact@wpscan.com
NVD status
Received

Social media

Hype score
Not currently trending

References

Sources include official advisories and independent security research.