Unrated severityNVD Advisory· Published Oct 21, 2026
CVE-2026-111957
CVE-2026-111957
Description
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being completed, nor check the payment amount against the order total, allowing unauthenticated users to mark a pending order as paid by replaying a payment identifier obtained from any single genuine payment.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <4.0.0
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.