CVE-2026-94361

{
  "etk_id": "ETK-2026-3155",
  "cve_id": "CVE-2026-94361",
  "display_id": "CVE-2026-94361",
  "ghsa_id": "GHSA-x7hw-7xvr-75fq",
  "euvd_id": "EUVD-2026-114590",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated payment-status changes in Payable Payment Gateway",
  "summary": "Payable Payment Gateway for WooCommerce versions before 1.3.1 do not authenticate incoming payment notifications. An unauthenticated remote attacker can alter the paid or failed status of store orders, including orders placed through other payment methods.",
  "mitigation": "Update Payable Payment Gateway for WooCommerce to version 1.3.1 or later. Restrict public access to payment-notification endpoints until the update is applied.",
  "vendor": null,
  "product": "Payable Payment Gateway for WooCommerce",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.3.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.3.1"
      ],
      "package_name": "Payable Payment Gateway for WooCommerce",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 29.694972983333333,
  "t0_at": "2026-10-31T06:00:23.604000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-31T06:00:23.604000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-31T06:00:23.604000+00:00",
      "url": "https://github.com/advisories/GHSA-x7hw-7xvr-75fq"
    }
  }
}