CVE-2026-96173

MediumCVSS 5.3

Published: 01/10/2026(UTC)Updated: 01/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Summary

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request. This allows unauthenticated attackers to obtain the order key of an arbitrary order and view its contents.

Risk Assessment

Unauthorized access to order details may expose customer data, including personal information and transaction details. This can breach customer privacy and trust.

Recommendation

Update the Payments for Hubtel plugin to version 1.0.2 or later. It is also recommended to check whether any unauthorized order access occurred.

Other vulnerabilities in Payments for Hubtel WordPress plugin

CVE-2026-96200Medium
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider. This allows unauthenticated attackers to mark arbitrary orders as paid without payment.

Original NVD description (English source)

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS