What is GHSA-r6r9-jfqh-hrq2?

GHSA-r6r9-jfqh-hrq2 is a security advisory published by GitHub Security Advisories with Medium severity. The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment...

Which CVE IDs does GHSA-r6r9-jfqh-hrq2 cover?

GHSA-r6r9-jfqh-hrq2 covers the following CVE IDs: CVE-2026-111957. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-r6r9-jfqh-hrq2?

GHSA-r6r9-jfqh-hrq2 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-r6r9-jfqh-hrq2MediumCVSS 5.3

The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment...

Vendor

GitHub Security Advisories

Published

October 21, 2026

Last Modified

October 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-111957 →

📋 Description

The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being completed, nor check the payment amount against the order total, allowing unauthenticated users to mark a pending order as paid by replaying a payment identifier obtained from any single genuine payment.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-111957
https://wpscan.com/vulnerability/751aa9b8-761e-4982-8708-6a746fddef09
https://github.com/advisories/GHSA-r6r9-jfqh-hrq2