All vulnerabilities
CVE-2026-106014

Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback Forgery

Unknown Gateway for Vantiv on WCNetwork & edge
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published19 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hosted-payment return handler, allowing unauthenticated attackers to mark orders as paid without actually paying.

Text from CVE List

Affected versions 1

  • Gateway for Vantiv on WCaffected: all versions through 1.0.1CVE List

References 1