CVE-2026-16738
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Conekta Payment Gateway WordPress plugin before version 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount. This allows unauthenticated attackers to mark arbitrary orders as paid without payment.
Risk Assessment
Attackers can trick the system into marking orders as paid without payment, leading to financial losses and compromise of order integrity.
Recommendation
Update the Conekta Payment Gateway plugin to version 6.2.2 or later. Additionally, implement your own webhook verification and payment-to-order binding.
Other vulnerabilities in Conekta Payment Gateway
Original NVD description (English source)
The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount, allowing unauthenticated attackers to mark arbitrary orders as paid without payment.