CVE-2026-16738
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The Conekta Payment Gateway WordPress plugin before version 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount. This allows unauthenticated attackers to mark arbitrary orders as paid without payment.
Risk Assessment
Attackers can trick the system into marking orders as paid without payment, leading to financial losses and compromise of order integrity.
Recommendation
Update the Conekta Payment Gateway plugin to version 6.2.2 or later. Additionally, implement your own webhook verification and payment-to-order binding.
Other vulnerabilities in Conekta Payment Gateway
See all- CVE-2026-95527Medium
The Conekta Payment Gateway plugin in versions up to and including 6.2.4 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. The flaw involves improper access control on plugin functionality.
- CVE-2026-49066High
The Conekta Payment Gateway versions up to 6.0.0 have a vulnerability that allows unauthenticated access to sensitive data.
Original NVD description (English source)
The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount, allowing unauthenticated attackers to mark arbitrary orders as paid without payment.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS