Unrated severityNVD Advisory· Published Oct 6, 2026

CVE-2026-94299

Description

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where that secret has been left at its default empty value.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/elegro Crypto Paymentllm-create
Range: <=1.0.1

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/7eb85c65-8dab-46e1-b1df-e5d966029b18/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000