CVE-2026-82215— WC PayPay Gateway 0.5 - 0.9.3 - Unauthenticated Payment Bypass via Unverified Webhook
Quick assessment
Affected
Unknown Payment Gateway PayPay for WooCommerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 插件 WooCommerce 的 PayPay 支付网关（版本 0.5 到 0.9.3）在处理支付通知时，未对通知的真实性进行验证，这使得知道该店铺商户标识符的未认证攻击者能够任意将订单标记为“已支付”，或将其取消或标记为“支付失败”。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Payment Gateway PayPay for WooCommerce | 0.5≤ 0.9.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82215
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WC PayPay Gateway 0.5 - 0.9.3 - Unauthenticated Payment Bypass via Unverified Webhook
Source: CVE Program / CVE List V5
Vulnerability Description
The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel or fail them.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Payment Gateway PayPay for WooCommerce | 0.5 ~ 0.9.3 | - |
|
II. Public POCs for CVE-2026-82215
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82215
请登录查看更多情报信息。
News Coverage for CVE-2026-82215 (1)
-
🔗 WC PayPay Gateway 0.5 – 0.9.3 – Unauthenticated Payment Bypass via Unverified Webhook | CVE 2026-82215 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-11 · 24 CVEs total
| CVE-2026-85116 | 6.5 MEDIUM | Simple CAPTCHA with Cloudflare Turnstile 1.2.2 - 1.42.1 - Unauthenticated Arbitrary Shortc |
| CVE-2026-86809 | 5.3 MEDIUM | Persian Elementor < 2.8.2 - Unauthenticated ZarinPal Payment Callback Authority Bypass |
| CVE-2026-82213 | 5.3 MEDIUM | Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR |
| CVE-2026-86813 | 4.8 MEDIUM | MetForm < 4.1.9 - Unauthenticated Email Header Injection via Notification Reply-To |
| CVE-2025-15695 | GTranslate < 3.0.10 - Admin+ Stored XSS | |
| CVE-2026-14559 | Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Account Takeover | |
| CVE-2026-83545 | CoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON | |
| CVE-2026-83546 | CoolClock < 4.3.8 - Contributor+ Stored XSS via Skin Class Attribute | |
| CVE-2026-14566 | Advanced Customized Prompts <= 1.0.1 - Subscriber+ WooCommerce Order Item Metadata Tamperi | |
| CVE-2026-14560 | Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload | |
| CVE-2026-14565 | Advanced Customized Prompts <= 1.0.1 - Subscriber+ Stored XSS via Product Popup Configurat | |
| CVE-2026-14563 | Advanced Customized Prompts <= 1.0.1 - Unauthenticated Account Takeover | |
| CVE-2026-14562 | Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosure | |
| CVE-2026-74925 | MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator | |
| CVE-2026-85677 | Gutenverse News < 3.3.3 - Unauthenticated Stored XSS via Comment Content | |
| CVE-2026-85678 | AI Builder 2.4.1 - 2.7.7 - Contributor+ Stored XSS via Post JavaScript | |
| CVE-2026-82305 | YITH WooCommerce Wishlist < 4.18.1 - Unauthenticated Arbitrary Wishlist Rename via change_ | |
| CVE-2026-86781 | SSL Zen < 4.7.40 - Subscriber+ TLS Private Key Disclosure | |
| CVE-2026-86780 | Featured Image with URL < 1.0.6 - Contributor+ Stored XSS via Image Alt Text | |
| CVE-2026-86779 | Visualizer < 4.0.6 - Contributor+ Arbitrary Chart Deletion via deleteChart |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-19856
All in One SEO < 5.0.2.1 - Unauthenticated Arbitrary Shortco -
CVE-2026-92924
Unlimited Elements For Elementor < 2.0.21 - Subscriber+ Arbi -
CVE-2026-97219
MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via -
CVE-2026-91020
WebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticat -
CVE-2026-90987
Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenti
V. Comments for CVE-2026-82215
No comments yet