CVE-2026-91075
MediumCVSS 5.3Summary
The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark a pending order as paid without paying for it.
Risk Assessment
An attacker can mark orders as paid without making payment, causing financial losses and improper order fulfillment. This may also lead to abuse in the sales process.
Recommendation
Update the Eupago Gateway For Woocommerce plugin to a version later than 4.7.5 that includes webhook authenticity verification. Until then, verify webhook signature validation configuration and monitor for unusual payment confirmations.
Other vulnerabilities in Eupago Gateway For Woocommerce
See all- CVE-2026-7862High
The Eupago Gateway plugin for WooCommerce before version 4.7.2 does not properly restrict access to its refund request handler, allowing unauthenticated attackers to initiate refunds against any WooCommerce order using the merchant's payment gateway credentials.
- CVE-2025-62870Medium
The Eupago Gateway For Woocommerce plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 4.7.1.
Original NVD description (English source)
The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark a pending order as paid without paying for it.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS