CVE-2026-94361— PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned Callback

Quick assessment

Affected

Unknown Payable Payment Gateway for WooCommerce

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WooCommerce WordPress 插件"Payable Payment Gateway"在 1.3.1 版本之前，在将 WooCommerce 订单标记为“已付款”或“失败”之前，未对传入的支付通知进行真实性验证。这允许未经认证的攻击者更改商店中任意订单的支付状态，无论该订单是通过何种支付方式创建的。

AI Predicted 8.1 Difficulty: Trivial Updated Oct 31, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1203 · Exploitation for Client Execution

Updated Oct 31, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned Callback

Source: CVE Program / CVE List V5

Vulnerability Description

The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed, allowing unauthenticated attackers to change the payment status of any order in the store regardless of the payment method it was placed with.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	Payable Payment Gateway for WooCommerce	0 ~ 1.3.1	-

II. Public POCs for CVE-2026-94361

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-94361

请登录查看更多情报信息。

Other References for CVE-2026-94361 (1)

https://wpscan.com/vulnerability/1c6a831e-2d14-4c73-8a9e-d28d9262f626/ exploit vdb-entry technical-description

https://www.cve.org/CVERecord?id=CVE-2026-94361

Same Patch Batch · Unknown · 2026-10-31 · 11 CVEs total

CVE-2026-118185		Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Limiting
CVE-2026-118629		All-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video Disclosure
CVE-2026-118438		Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute
CVE-2026-118638		Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker RE
CVE-2026-118437		BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion
CVE-2026-82214		Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure vi
CVE-2026-118184		Premium Packages < 7.2.2 - Unauthenticated Order Total Manipulation
CVE-2026-118043		Bulk Media Register < 2.01 - Author+ Arbitrary File Move via Path Traversal
CVE-2026-110808		Essential Addons for Elementor 6.6.0 - 6.8.7 - Author+ Privilege Escalation via register_u
CVE-2026-110042		Payment Forms for Paystack < 4.0.6 - Contributor+ Sensitive Information Disclosure via Set

IV. Related Vulnerabilities

Same vendor: Unknown