CVE-2026-96200

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider. This allows unauthenticated attackers to mark arbitrary orders as paid without payment.

Attackers can mark orders as paid without actual payment, leading to financial losses and fraud. The risk affects any site using this plugin.

Update the Payments for Hubtel plugin to version 1.0.2 or later. An audit of orders marked as paid is also recommended to detect abuse.