medium5.3
CVE-2026-111957
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being completed, n…
Impact
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being completed, nor check the payment amount against the order total, allowing unauthenticated users to mark a pending order as paid by replaying a payment identifier obtained from any single genuine payment.
Affected products
| Product | Affected versions |
|---|---|
| SUMIT Payment Gateway For WooCommerce WordPress Plugin | before 4.0.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.