CVE-2026-94270
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification disabled by default, allowing unauthenticated attackers to mark an unpaid order as paid, or to cancel or refund an existing order.
Risk Assessment
The risk includes the ability to manipulate order statuses, which may lead to financial losses and compromise of order process integrity.
Recommendation
It is recommended to update the Deema Payment Gateway plugin to a patched version and enable notification authenticity verification.
Other vulnerabilities in Deema Payment Gateway
Original NVD description (English source)
The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification disabled by default, allowing unauthenticated attackers to mark an unpaid order as paid, or to cancel or refund an existing order.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS