{"id":"CVE-2026-94295","published":"2026-10-25T06:16:33.037","lastModified":"2026-10-26T13:52:56.910","description":"The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before marking the associated order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made.","cvssScore":5.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/d6ee17a1-0db1-4610-8c96-96e98fb734ec/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}