Authentication Flaw in Chikkili-Google Pay Plugin for WooCommerce by WordPress
CVE-2026-94295
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 25 October 2026
Badges
What is CVE-2026-94295?
The Chikkili-Google Pay India for WooCommerce plugin version 1.0.6 suffers from an improper authentication issue. This vulnerability does not adequately verify the origin of payment notifications before marking associated orders as paid. As a result, unauthorized attackers can exploit this flaw to mark orders as paid without legitimate transactions, potentially leading to financial losses for merchants. Proper validation mechanisms must be enforced to mitigate such risks and ensure that only verified payment notifications update order statuses.
Affected Version(s)
Chikkili- Google Pay India for Woocommerce 0 <= 1.0.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.