VULNERABILITY INTELLIGENCE
CVE-2026-10599
CVSS score7.5 HIGH
EPSS probability0.21%
CISA KEVNot currently listed
Published2026-08-06
Last modified2026-08-26
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Description
The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the order being marked as paid, nor does it verify the authenticity of its payment-completion request, allowing unauthenticated attackers to reuse a single valid transaction to mark arbitrary orders as paid and bypass payment.
Weakness classification
- CWE-345: Insufficient Verification of Data Authenticity
- CWE-639: Authorization Bypass Through User-Controlled Key