All vulnerabilities
CVE-2026-94295

Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forgery via Unverified Signature

Unknown Chikkili- Google Pay India for Woocommerce
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version yet
Published25 Oct 2026Updated 25 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before marking the associated order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made.

Text from CVE List

Affected versions 1

  • Chikkili- Google Pay India for Woocommerceaffected: all versions through 1.0.6CVE List

References 1