Security Alert Summary
The Chikkili- Google Pay India for Woocommerce plugin through 1.0.6 fails to verify that incoming payment notifications originate from the payment provider. As a result, unauthenticated attackers can trigger the plugin to mark arbitrary orders as paid without any payment being made.
CVE Details
- CVE ID: CVE-2026-94295
- Affected component: Chikkili- Google Pay India for Woocommerce WordPress plugin
- Affected versions: Through 1.0.6 (versions up to and including 1.0.6)
- Published: October 25, 2026 at 06:16:33 AM UTC
- Last modified: October 25, 2026 at 06:16:33 AM UTC
- CVSS v3.1: Not provided in the CVE record
- Authentication / Privileges / User interaction: No authentication required; no privileges required; no user interaction required (unauthenticated attacker can exploit)
- Primary impact: Integrity (orders can be marked paid without payment). Confidentiality: not indicated. Availability: not indicated.
- CWE / weakness ID: Not specified
Technical Details
The vulnerability exists because the plugin does not verify that a received payment notification actually originated from the payment provider before updating order status. The lack of origin or authenticity checks on incoming notifications allows an unauthenticated actor to send a crafted notification and cause the plugin to mark an associated WooCommerce order as paid.
The CVE description does not name specific functions, routes, or REST endpoints. Based on the reported behavior, the missing check is in the code path that processes payment notifications and updates order status. The impact is limited to orders being incorrectly marked as paid; the record indicates no additional automatic elevation of WordPress user privileges or direct server access.
How This Could Impact Your Website
Consider a small store where a site owner manages orders, an internal staff member fulfills shipments, and an external contractor helps with customer emails. An attacker could mark one or more orders as paid without actually completing a transaction. That may lead staff to ship products or provide services for which no payment was received, causing financial loss and reconciliation problems.
Even if customer payment data is not exposed by this issue, fraudulent paid orders can create operational confusion, and they may reveal which customers placed orders if records are accessed during investigation. This in turn increases the risk of targeted phishing or social engineering against staff or customers using information gathered from order records.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level or higher roles for external users.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site and order activity for unusual behavior, including unexpected order status changes and fulfillment actions.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
