CVE-2026-94271

MediumCVSS 5.3/10Last modified Oct 6, 2026

Description

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being taken.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Oct 6, 2026
Last modified: Oct 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-942725.3The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authoris CVE-2026-942735.3The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approve CVE-2026-942745.3The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, incl CVE-2026-942755.3The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, CVE-2026-942765.1Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authori CVE-2026-942776.3MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via spri CVE-2026-942785.5The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachmen CVE-2026-94288.8A vulnerability has been found in Tenda F1202 1.2.0.20(408). Affected is the function fromPPTPUserSetting of the file /goform/PPTPUserSettin CVE-2026-942816.5An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an at CVE-2026-942825.6An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash CVE-2026-942836.5An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X s CVE-2026-942845.5An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X ser