Improper Authentication in CamPay Shortcode Payment Gateway by WordPress
CVE-2026-105975
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 14 October 2026
Badges
What is CVE-2026-105975?
The CamPay Shortcode Payment Gateway plugin for WordPress prior to version 1.7 suffers from a significant security flaw that undermines the verification of Mobile Money payment confirmations. This vulnerability allows unauthenticated users to manipulate payment records by asserting that transactions are paid based solely on client-supplied parameters. As a result, malicious actors can mark records as paid without legitimate proof, erase valid payment data, and inject unauthorized meta information into WordPress posts. Website owners using this plugin should urgently update to the latest version to mitigate the risk of exploitation.
Affected Version(s)
CamPay Shortcode Payment Gateway 0 < 1.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.