CVE-2026-94299: CWE-863 Incorrect Authorization in elegro Crypto Payment
Description
The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where that secret has been left at its default empty value.
CVSS v3.1
Score 6.5medium
Affected software
elegro Crypto Payment
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-94299 describes an incorrect authorization vulnerability (CWE-863) in the elegro Crypto Payment WordPress plugin through version 1.0.1. The plugin fails to require a configured shared secret before trusting incoming payment notification requests. If the shared secret remains at its default empty setting, unauthenticated attackers can forge payment confirmations and alter order statuses arbitrarily on affected installations.
Potential Impact
An attacker can impersonate payment notifications without authentication, potentially causing fraudulent order status changes. This could lead to financial discrepancies or unauthorized order processing on affected WordPress sites using the plugin with default or unset shared secrets.
Mitigation Recommendations
No patch or official fix information is provided in the available data. Users should ensure that a shared secret is properly configured and not left empty to prevent unauthorized payment notification acceptance. Check the vendor advisory for updates or patches addressing this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-21T09:45:35.363Z
- State
- PUBLISHED
Threat ID: 6ac4964c2cdf04f656856a3f
Added to database: 10/06/2026, 06:33:48 UTC
Last enriched: 10/06/2026, 06:48:12 UTC
Last updated: 10/06/2026, 18:57:28 UTC
Views: 21
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.