Authentication Bypass in WordPress Plugin for Payment Processing by Vantiv
CVE-2026-106014

Currently unrated

Key Information:

Vendor

WordPress
Status
Gateway For Vantiv On Wc
Vendor
CVE Published:
19 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-106014?

The Gateway for Vantiv on the WordPress platform fails to verify the authenticity of payment notifications received through its hosted-payment return handler. This oversight allows unauthorized individuals to manipulate order statuses, enabling them to falsely mark orders as paid without completing actual transactions. As a result, this vulnerability poses significant risks to the integrity of payment processing and could lead to financial losses for merchants and service providers using this plugin.

Affected Version(s)

Gateway for Vantiv on WC 0 <= 1.0.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-106014 - Proof of Concept

References

https://wpscan.com/vulnerability/30ccd424-a0a1-40a9-93ab-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Enrico Marcolini - Claudio Marchesini - Dottor Marc
WPScan
.