blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-82215

MEDIUM 5.9 CVSS 3.1
Published
September 11, 2026
Last modified
September 11, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-345
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel or fail them.

Affected WordPress components

  • Payment Gateway PayPay for WooCommerce Plugin · wc-paypay-gateway
    Possible match Active
    From 0.5 (including) to 0.9.3 (including)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Payment Gateway PayPay for WooCommerce — From 0.5 (including) to 0.9.3 (including)

References

  • wpscan.com https://wpscan.com/vulnerability/c7703a51-9d5d-4483-b214-7249701ee9ff/
  • nvd.nist.gov Official NVD record