CVE-2026-94295: Chikkili- Google Pay India for Woocommerce · Missing Authorization
Affects Chikkili- Google Pay India for WoocommerceSource CVE Database V5
Not known to be exploited.
Data as of 10/25/2026, 08:15:02 UTC
Rated High by the CNA (WPScan) · CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Chikkili- Google Pay India for Woocommerce | Affected
| Fixed in– |
AI-suggested
Users should monitor the vendor advisory for updates. Until a fix is available, consider disabling the plugin or implementing additional verification controls on payment notifications to ensure authenticity.
Description
The Chikkili- Google Pay India for Woocommerce WordPress plugin up to version 1.0.6 contains a missing authorization vulnerability. It fails to verify that payment notifications originate from the legitimate payment provider before marking orders as paid. This flaw allows unauthenticated attackers to mark arbitrary orders as paid without making any actual payment.
Impact
An attacker can mark any order as paid without completing a legitimate payment transaction. This could lead to financial loss for merchants using the affected plugin, as orders may be fulfilled without receiving payment.
Weaknesses
- CWE-862Missing Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #4OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.