CVE-2026-96173 — Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, all…
Published: 2026-10-01 · CVSS: 5.3 · CVSS 3.1
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7