CVE-2026-96173 is an authorization bypass vulnerability in the Payments for Hubtel WordPress plugin prior to version 1.0.2. The plugin fails to verify that the requester is authorized to view an order before redirecting a public payment-callback request. This allows unauthenticated attackers to obtain the order key of arbitrary orders and view their contents, violating access control policies. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

An attacker can retrieve sensitive order information without authentication by exploiting the lack of authorization checks on payment-callback requests. The confidentiality of order data is compromised, but there is no indication of integrity or availability impact. The CVSS v3.1 base score is 5.3 (medium severity), reflecting the network attack vector, low complexity, no privileges required, no user interaction, and limited impact to confidentiality only.

A fixed version 1.0.2 or later should be applied to address this vulnerability. Since the affected versions are prior to 1.0.2, upgrading to 1.0.2 or newer will remediate the issue. No vendor advisory or patch link was provided, so confirm patch availability from the official plugin source before upgrading.