CVE-2026-10599 Integrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass via Transaction ID Reuse
Unauthenticated attackers can bypass payment verification by reusing transaction IDs to mark arbitrary orders as paid in the Integrate PhonePe with WooCommerce plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-10599?
CVE-2026-10599 is a high-severity vulnerability in Unknown Integrate PhonePe with WooCommerce, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the order being marked as paid, nor does it verify the authenticity of its payment-completion request, allowing unauthenticated attackers to reuse a single valid transaction to mark arbitrary orders as paid and bypass payment.
Which versions are affected by CVE-2026-10599?
How do I fix CVE-2026-10599?
No fix has been published for CVE-2026-10599 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-10599 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-10599 exists.
Sources
Also known as GHSA-x972-w82m-gqc5.