CVE-2026-94299

Published 6 October 2026 · tracked since 7 October 2026

Description

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where tha

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-107204 CRITICAL 9.8
• CVE-2026-106559 MEDIUM 6.3
• CVE-2026-106560 HIGH 7.1
• CVE-2026-106561 MEDIUM 5
• CVE-2026-106563 MEDIUM 5.3
• CVE-2026-106558 HIGH 8.8
• CVE-2026-106510 HIGH 7.7
• CVE-2026-106556 HIGH 7.7
• CVE-2025-70521 CRITICAL 9.8
• CVE-2025-70518 CRITICAL 10

→ Open the live CVE board · all tools