CVE-2026-16738

MediumCVSS 5.3/10Last modified Oct 12, 2026

Description

The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount, allowing unauthenticated attackers to mark arbitrary orders as paid without payment.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Aug 22, 2026
Last modified: Oct 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-167395.9The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.4 does not verify that a payment-confirmation request originates from the CVE-2026-16746.5The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to una CVE-2026-167409.8Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber Defense CVE-2026-167419.8Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TR7 Cyber Defense Inc. TR7 ASP CVE-2026-167426.7systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user CVE-2026-167435.5A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validati CVE-2026-167458.8A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious CVE-2026-167462.7The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API CVE-2026-167476.5The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled CVE-2026-16755.3The Advanced Country Blocker plugin for WordPress is vulnerable to Authorization Bypass in all versions up to, and including, 2.3.1 due to t CVE-2026-167505.3The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing au CVE-2026-167516.5Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker c