CVE-2026-94299: 
WordPress vulnerability analysis and mitigation

CVE-2026-94299 is an Incorrect Authorization vulnerability in the elegro Crypto Payment WordPress plugin (versions through 1.0.1) that allows unauthenticated attackers to forge payment confirmations and arbitrarily change the status of orders via a spoofed IPN (Instant Payment Notification) callback. The vulnerability was publicly disclosed on October 3, 2026, and was discovered by researcher JunHee CHO. There is currently no known fix available for the affected plugin. It carries a CVSS v3.1 base score of 6.5 (Medium) per Feedly/NVD analysis, though WPScan rates it 5.3 (Medium) (WPScan).

The root cause is classified as CWE-863 (Incorrect Authorization): the plugin processes incoming payment notification (IPN callback) requests without verifying a shared secret, which is left empty by default. Because no authentication or integrity check is enforced on these webhook-style callbacks, any unauthenticated network attacker can send a crafted HTTP request mimicking a legitimate payment notification to the plugin's IPN endpoint. This causes the plugin to trust the forged request and update WooCommerce order statuses accordingly. A proof-of-concept is scheduled for public release on October 17, 2026, to allow time for users to update (WPScan).

Successful exploitation allows an unauthenticated attacker to mark arbitrary WooCommerce orders as paid or completed without making any actual cryptocurrency payment, directly enabling fraud against merchants using the plugin. This results in integrity loss (unauthorized order status manipulation) and limited confidentiality impact (potential exposure of order information), with no direct availability impact. The attack is automatable and requires no user interaction, making it feasible to target all vulnerable installations at scale (WPScan).

No active in-the-wild exploitation has been reported at this time, and no public proof-of-concept exploit code is currently available (PoC is scheduled for release on October 17, 2026). The NVD SSVC assessment marks the vulnerability as automatable with no known exploitation. The EPSS score is approximately 0.136%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (WPScan).

1. Reconnaissance: Identify WordPress sites using the elegro Crypto Payment plugin (version ≤ 1.0.1) via passive scanning tools (e.g., WPScan, Shodan) or by checking publicly accessible plugin metadata at /wp-content/plugins/elegro-payment/.
2. Locate IPN endpoint: Identify the plugin's payment notification callback URL, typically registered as a WordPress REST API or custom endpoint that the plugin exposes to receive cryptocurrency payment status updates.
3. Craft forged IPN request: Construct an HTTP POST request mimicking a legitimate payment notification from the cryptocurrency payment processor, including parameters such as order ID and payment status set to a confirmed/completed value. Since no shared secret is required (or the secret is empty by default), no HMAC signature or token is needed.
4. Submit forged notification: Send the crafted request to the IPN endpoint. The plugin, lacking secret validation, accepts the request as legitimate.
5. Order status updated: The targeted WooCommerce order is marked as paid/completed, allowing the attacker to receive goods or services without making an actual payment (WPScan).

• Network: Unexpected HTTP POST requests to the elegro Crypto Payment plugin's IPN/callback endpoint from unknown or suspicious IP addresses, particularly with no corresponding legitimate transaction on the cryptocurrency network.
• Logs: WordPress access logs showing POST requests to the plugin's payment notification endpoint without a valid shared secret header or with an empty secret value; multiple rapid requests targeting different order IDs.
• Application: WooCommerce orders marked as paid or completed with no corresponding on-chain cryptocurrency transaction; orders whose status changed without a matching payment record in the elegro payment dashboard.
• File System: No specific file artifacts expected, but review plugin configuration files for the shared secret field being empty or unconfigured.

As of the disclosure date, there is no known patched version of the elegro Crypto Payment plugin available. Site administrators should immediately consider deactivating and removing the plugin until a fix is released. As a workaround, administrators can manually configure a strong shared secret within the plugin settings if the option exists, or implement web application firewall (WAF) rules to restrict access to the plugin's IPN callback endpoint to known payment processor IP ranges only. Monitor WooCommerce orders closely for suspicious status changes that lack corresponding on-chain payment verification (WPScan).

Wordfence included this vulnerability in their weekly WordPress vulnerability report covering the period of September 28 – October 4, 2026, highlighting it among a broader set of plugin issues. A Reddit thread in r/StopBadBots referenced a list of 51 WordPress plugins with unpatched vulnerabilities, which appears to include this issue, reflecting community concern about the lack of a fix. No major vendor statements or prominent individual researcher commentary beyond the original discoverer (JunHee CHO) have been identified (Wordfence Blog).