CVE-2026-10599— Integrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass via Transaction ID Reuse
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Integrate PhonePe with WooCommerce | ≤ 1.2.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-10599
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Integrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass via Transaction ID Reuse
Source: CVE Program / CVE List V5
Vulnerability Description
The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the order being marked as paid, nor does it verify the authenticity of its payment-completion request, allowing unauthenticated attackers to reuse a single valid transaction to mark arbitrary orders as paid and bypass payment.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Integrate PhonePe with WooCommerce 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Integrate PhonePe with WooCommerce是WordPress基金会的一款电商支付集成插件。 WordPress Integrate PhonePe with WooCommerce 1.2.1及之前版本存在安全漏洞，该漏洞源于未验证已确认的支付交易是否属于被标记为已支付的订单，也未验证支付完成请求的真实性，可能导致未经身份验证的攻击者重用单个有效交易将任意订单标记为已支付并绕过支付。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Integrate PhonePe with WooCommerce | 0 ~ 1.2.1 | - |
II. Public POCs for CVE-2026-10599
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-10599
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-10599 (1)
Same Patch Batch · Unknown · 2026-08-06 · 49 CVEs total
| CVE-2026-11976 | 10.0 CRITICAL | MonsterInsights Pro 10.2.0/10.2.2 - Backdoored via AWS S3 bucket compromise |
| CVE-2026-14812 | 10.0 CRITICAL | Premium SEO - Unauthenticated Backdoor (Admin Creation / RCE / SSRF / Content Injection) |
| CVE-2026-17032 | 9.8 CRITICAL | Supsystic Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server |
| CVE-2026-3430 | 8.6 HIGH | Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi |
| CVE-2026-12584 | 7.5 HIGH | Payment Gateway for Redsys & WooCommerce Lite < 7.0.2 - Unauthenticated Payment Confirmati |
| CVE-2026-16620 | 7.5 HIGH | WPC Name Your Price for WooCommerce < 2.2.5 - Unauthenticated Price Manipulation via Selec |
| CVE-2026-10524 | 7.5 HIGH | CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation |
| CVE-2026-13399 | 7.5 HIGH | Payment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse |
| CVE-2026-16619 | 7.5 HIGH | miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts |
| CVE-2026-5336 | 6.8 MEDIUM | Dataverse Integration < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Infor |
| CVE-2026-11361 | 5.9 MEDIUM | Formidable Forms < 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Sub |
| CVE-2026-12901 | 5.9 MEDIUM | GetPaid < 2.8.55 - Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verificati |
| CVE-2026-15149 | 5.3 MEDIUM | WP Hotel Booking < 2.3.3 - Unauthenticated Payment Bypass via Price Manipulation |
| CVE-2026-16067 | 5.3 MEDIUM | Event Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via C |
| CVE-2026-13342 | 5.3 MEDIUM | Security Optimizer – The All-In-One Protection Plugin < 1.6.5 - Login Access IP Allowlist |
| CVE-2026-14842 | 5.3 MEDIUM | Events Made Easy < 3.1.2 - Unauthenticated Payment Bypass |
| CVE-2026-14831 | 5.3 MEDIUM | Easy Booking < 3.5.0 - Unauthenticated Minimum Booking Duration Bypass |
| CVE-2026-15147 | 5.3 MEDIUM | Five Star Restaurant Reservations < 2.7.23 - Unauthenticated Payment Bypass and Booking Co |
| CVE-2026-15208 | 5.3 MEDIUM | RegistrationMagic < 6.0.9.5 - Unauthenticated Payment Bypass via Amount-Blind PayPal Verif |
| CVE-2026-14936 | 5.3 MEDIUM | Simple Membership < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver |
Showing top 20 of 49 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Unknown
- CVE-2026-14548
Ray Enterprise Translation <= 1.7.3 - Subscriber+ Arbitrary - CVE-2026-14549
Ray Enterprise Translation <= 1.7.3 - Subscriber+ Language A - CVE-2026-19075
All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side R - CVE-2026-19074
Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticat - CVE-2026-19089
Product Input Fields for WooCommerce < 2.0.2 - Unauthenticat
V. Comments for CVE-2026-10599
No comments yet