What is GHSA-4vwp-q9wh-xxq2?

GHSA-4vwp-q9wh-xxq2 is a security advisory published by GitHub Security Advisories with Medium severity. The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of...

Which CVE IDs does GHSA-4vwp-q9wh-xxq2 cover?

GHSA-4vwp-q9wh-xxq2 covers the following CVE IDs: CVE-2026-16738. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4vwp-q9wh-xxq2?

GHSA-4vwp-q9wh-xxq2 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-4vwp-q9wh-xxq2MediumCVSS 5.3

The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of...

Vendor

GitHub Security Advisories

Published

August 22, 2026

Last Modified

August 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-16738 →

📋 Description

The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount, allowing unauthenticated attackers to mark arbitrary orders as paid without payment.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-16738
https://wpscan.com/vulnerability/89a2917e-032c-4f0f-be44-1a50b9d6fddf
https://github.com/advisories/GHSA-4vwp-q9wh-xxq2