CVE-2026-94271CWE-287

CVE-2026-94271

Medium · published October 6, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
7.4
In the wild
Unconfirmed
What it is

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being taken.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00182 · 7.4th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-10-06T11:16Z
References (1)
https://wpscan.com/vulnerability/9455978a-b406-4456-9054-a516c117bdbf/ · [email protected]
EPSS history
Timeline
  • 07 OCT 03:43Z
    EPSS moved — → 0%
    epss
  • 06 OCT 06:00Z
    Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return
    cvelistv5