CVE-2026-82215

MediumCVSS 5.9/10Last modified Sep 11, 2026

Description

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel or fail them.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-345

Affected software

No affected versions have been published.

Timeline

Published
Sep 11, 2026
Last modified
Sep 11, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-822178.8In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContentCVE-2026-82227.5A vulnerability has been found in Open5GS up to 2.7.7. Affected is the function pcf_nbsf_management_handle_register of the file src/pcf/nbsfCVE-2026-822205.3Unauthenticated Other Vulnerability Type in Forminator <= 1.57.1 versions.CVE-2026-822217.1Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.CVE-2026-8222210.0Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from nCVE-2026-822236.5Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.CVE-2026-822247.1Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.CVE-2026-822257.4Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions.CVE-2026-822269.8Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.CVE-2026-822278.5Contributor SQL Injection in WPBulky <= 1.2.2 versions.CVE-2026-822288.1Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.CVE-2026-822297.1Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.
CVE-2026-82215: Medium severity, CVSS 5.9 | Vulnix