IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
5.3Mittel

CVE-2026-121633Order Tracking < 3.6.0 - Unauthenticated Payment Confirmation Forgery via PayPal IPN Listener

Order Tracking Veröffentlicht: (vor 6 Tagen)

Beschreibung

The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment notification was sent to the merchant's account, or that its amount matches the order total, before marking an order as paid, which could allow unauthenticated attackers to mark arbitrary orders as paid using a trivial payment to their own PayPal account.

Schwachstellentyp (CWE): CWE-345

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
— Order Tracking < 3.6.0

Referenzen und Patches

Neue CVEs im selben Produkt — WordPress plugins & themes

Ohne Score
CVE-2026-125711

Trustindex Review Widget Plugins < 14.3 - Editor+ Stored XSS via Business Name

Widgets for Google Reviews; WP Tripadvisor Review Widgets; Widgets for Booking.com Reviews; Widgets for Reviews & Recommendations

The Widgets for Google Reviews WordPress plugin before 14.3, WP Tripadvisor Review Widgets WordPress plugin before 14.3, Widgets for Booking.com Reviews WordPress plugin before 14.3, Widgets for Reviews & Recommendations WordPress plugin before 14.3, Widgets …