CVE-2026-88928
CVE-2026-88928 · PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification Bypass
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwrite the stored payment token associated with existing orders and delete saved card records.
CVSS 6.5 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
paycomet for woocommerce
- Versions
- ≥ 5.36, < 5.46: Affected (semver)
Update to 5.46