CVE-2026-91075
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Nov 03, 2026
Vendor
unknown
Description
The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark a pending order as paid without paying for it.