Description
The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hosted-payment return handler, allowing unauthenticated attackers to mark orders as paid without actually paying.
Published: 2026-10-19
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Order Payment
Action: Immediate Patch
AI Analysis

Impact

The Gateway for Vantiv on WC plugin up to version 1.0.1 does not verify the authenticity of payment notifications received by its hosted-payment return handler. This omission allows attackers to send forged callbacks that convince the system that an order has been paid, enabling them to mark orders as paid without completing a legitimate transaction.

Affected Systems

The vulnerability affects the Gateway for Vantiv on WC WordPress plugin for all versions up to and including 1.0.1. The plugin is distributed by an unnamed vendor and is deployed on WordPress storefronts that process payments through the Vantiv gateway.

Risk and Exploitability

Attackers can craft and submit payment callbacks from any remote location because the return handler performs no authentication checks. The flaw does not require prior access to the site. No EPSS score is available, the vulnerability is not listed in the CISA KEV catalog, and the CVSS score of 5.3 indicates a medium severity that can lead to unauthorized order payments.

Generated by OpenCVE AI on October 19, 2026 at 13:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Gateway for Vantiv on WC plugin to version 1.0.2 or newer if available
  • Verify that payment notifications are authenticated, for example by checking digital signatures, merchant identifiers, or an API key supplied by Vantiv
  • Implement monitoring of order status changes and flag any orders marked as paid without a corresponding legitimate payment transaction

Generated by OpenCVE AI on October 19, 2026 at 13:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress-extensions
Wordpress-extensions gateway For Vantiv On Wc
Vendors & Products Wordpress-extensions
Wordpress-extensions gateway For Vantiv On Wc

Mon, 19 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287

Mon, 19 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287

Mon, 19 Oct 2026 06:15:00 +0000

Type Values Removed Values Added
Description The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hosted-payment return handler, allowing unauthenticated attackers to mark orders as paid without actually paying.
Title Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback Forgery
References

Subscriptions

Wordpress-extensions Gateway For Vantiv On Wc
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-19T09:31:19.387Z

Reserved: 2026-10-06T12:24:50.773Z

Link: CVE-2026-106014

cve-icon Vulnrichment

Updated: 2026-10-19T09:22:13.190Z

cve-icon NVD

Status : Deferred

Published: 2026-10-19T06:17:17.607

Modified: 2026-10-19T21:04:50.950

Link: CVE-2026-106014

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T17:01:01Z

Weaknesses