CVE-2026-91075

Medium · 5.3

CVSS

5.3

EPSS

0.1%

Published

Nov 3, 2026

CISA due date

—

The record

The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark a pending order as paid without paying for it.

Affected packages

Ecosystem	Package	Introduced	Fixed