CVE-2026-87843: CWE-284 Improper Access Control in Trust Payments Gateway for WooCommerce
Description
The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from the hosted payment page, nor bind that response to the targeted order or check the amount, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made, and to retrieve order and customer details.
CVSS v3.1
Score 6.5medium
Affected software
Trust Payments Gateway for WooCommerce
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-87843 is an improper access control vulnerability (CWE-284) in the Trust Payments Gateway for WooCommerce WordPress plugin prior to version 3.1.0. The plugin fails to verify the authenticity of the payment provider's response upon customer return from the hosted payment page. It also does not bind the response to the specific order or check the payment amount, enabling unauthenticated attackers to mark arbitrary orders as paid without any payment and to access order and customer information.
Potential Impact
Attackers can fraudulently mark orders as paid without making any payment, potentially leading to financial loss for merchants. Additionally, unauthorized access to order and customer details may result in privacy breaches.
Mitigation Recommendations
Upgrade to version 3.1.0 or later of the Trust Payments Gateway for WooCommerce plugin where this vulnerability is fixed. No other mitigation guidance is provided. Patch status is confirmed by the version boundary in the affectedVersions field.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-09T11:26:53.971Z
- State
- PUBLISHED
Threat ID: 6acf22582cdf04f656513ba5
Added to database: 10/14/2026, 06:34:00 UTC
Last enriched: 10/14/2026, 06:49:45 UTC
Last updated: 10/14/2026, 19:00:33 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.