CVE-2026-96200 — Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Payment Callback
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauth…
Published: 2026-10-01 · CVSS: 5.3 · CVSS 3.1
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7