CVE-2026-87843
The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns fr…
Published Oct 14, 2026 · updated Oct 14, 2026
The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from the hosted payment page, nor bind that response to the targeted order or check the amount, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made, and to retrieve order and customer details.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · NIST NVD
Detected
The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from the hosted payment page, nor bind that response to the targeted order or check the amount, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made, and to retrieve order and customer deta
Oct 14, 2026 · NIST NVD
Updated
The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from the hosted payment page, nor bind that response to the targeted order or check the amount, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made, and to retrieve order and customer deta
Sources
- CVE.orgCVE-2026-87843
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-87843
30-day exploitation probability 0.2%
first.org - NIST NVDCVE-2026-87843
The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from the hosted payment page, nor bind that response to the targeted order or check the amount, allowing unauthenti
nvd.nist.gov