Security Alert Summary
The SUMIT Payment Gateway for WooCommerce plugin before 4.0.0 fails to verify that payment notifications actually originate from the payment provider before marking orders as paid. This allows unauthenticated users to mark pending orders as paid without completing payment.
CVE Details
- CVE ID: CVE-2026-84091
- Affected component: SUMIT Payment Gateway for WooCommerce (WordPress plugin)
- Affected versions: Versions before 4.0.0 (less than 4.0.0)
- Published: September 23, 2026 at 1:17:30 PM UTC
- Last modified: September 23, 2026 at 1:17:30 PM UTC
- CVSS v3.1 base score: 5.3
- CVSS v3.1 severity: MEDIUM
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Authentication / privileges / user interaction: No authentication required; privileges required: None; user interaction: None
- Primary impact: Confidentiality: None; Integrity: Low; Availability: None
- Weakness (CWE): CWE-287 (Improper Authentication)
Technical Details
The plugin does not verify with the payment provider that an incoming payment notification is genuine before updating the corresponding WooCommerce order status to paid. Because the notification origin or authenticity check is missing or not enforced, an unauthenticated actor can trigger the same code path that marks a pending order as paid without actually completing a payment transaction.
The vulnerability exists in the payment notification handling logic: the plugin accepts and processes payment notifications without a reliable verification step that confirms the notification was issued by the payment provider. The description does not name specific functions or REST endpoints.
Impact is limited to order state integrity: orders can be fraudulently marked as paid. The CVSS impact metrics reflect integrity impact only and do not indicate confidentiality or availability loss.
How This Could Impact Your Website
Consider a typical small business WordPress site using WooCommerce with multiple users: the site owner manages settings, an internal staff member handles orders, and an external contractor or contributor helps with content. If the SUMIT gateway is installed in a vulnerable version, an unauthenticated actor could mark pending orders as paid. Practical consequences include mismatches between payment records and order status, manual reconciliation overhead for staff, and potential fulfillment of orders that were not actually paid for.
Even though the vulnerability does not directly expose user passwords or site files, it can increase risk to staff and customers. For example, internal email addresses used for order notifications could be confirmed indirectly, enabling more targeted phishing or social engineering against staff who process orders.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor roles and accounts that do not require payment handling privileges.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce the attack surface.
- Monitor site activity and order logs for unusual behavior, such as orders marked paid without corresponding payment provider confirmations.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
