Payment Confirmation Exploit in SUMIT Payment Gateway for WooCommerce by WordPress
CVE-2026-111957

Currently unrated

Key Information:

Vendor

WordPress
Status
Sumit Payment Gateway For WooCommerce
Vendor
CVE Published:
21 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-111957?

The SUMIT Payment Gateway for WooCommerce plugin prior to version 4.0.0 allows unauthenticated users to incorrectly mark pending orders as paid. This occurs because the plugin does not associate confirmed payments with their respective orders, nor does it validate the payment amount against the total order price. This oversight exposes users to significant risks as it permits the replay of payment identifiers from legitimate transactions, potentially misleading the system into believing that an order has been successfully paid.

Affected Version(s)

SUMIT Payment Gateway for WooCommerce 0 < 4.0.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-111957 - Proof of Concept

References

https://wpscan.com/vulnerability/751aa9b8-761e-4982-8708-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Enrico Marcolini
Claudio Marchesini
Dottor Marc
WPScan
.