CVE-2026-94270 Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass and Order Manipulation via Webhook
Unauthenticated attackers can manipulate order statuses by bypassing webhook verification in the Deema Payment Gateway plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-94270?
CVE-2026-94270 is a medium-severity authentication bypass vulnerability in Unknown Deema Payment Gateway, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification disabled by default, allowing unauthenticated attackers to mark an unpaid order as paid, or to cancel or refund an existing order.
Weakness: CWE-287
Which versions are affected by CVE-2026-94270?
How do I fix CVE-2026-94270?
No fix has been published for CVE-2026-94270 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-94270 being exploited?
There is no known exploitation of CVE-2026-94270 in the wild and no public exploit code.
Sources
Also known as GHSA-jw44-pc5c-qfmc.