{"affected":[],"cveId":"CVE-2026-94361","cwes":["CWE-862"],"description":"The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed, allowing unauthenticated attackers to change the payment status of any order in the store regardless of the payment method it was placed with.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1793557094020,"publishedAt":1793427395460,"references":[{"source":"contact@wpscan.com","tags":[],"url":"https://wpscan.com/vulnerability/1c6a831e-2d14-4c73-8a9e-d28d9262f626/"}],"remediation":[],"revision":"b89779b984e9ea57525b6a77c1c285d00638f1770aaf07282b10fe585317bd6a","sources":[{"modifiedAt":1793557094020,"name":"NVD","retrievedAt":1793578553125,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94361"}],"ssvc":{"assessedAt":1793554000490,"automatable":"yes","exploitation":"none","source":"NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0","technicalImpact":"partial"},"status":"published","title":"CVE-2026-94361","updatedAt":1793578553125}