Vulnerability · Published Aug 6, 2026 · Assigned by WPScan

CVE-2026-10599Integrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass via Transaction ID Reuse

High 7.5

In plain English

A high-severity authorization bypass via user-controlled key in Integrate PhonePe with WooCommerce from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.2%top 88.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the order being marked as paid, nor does it verify the authenticity of its payment-completion request, allowing unauthenticated attackers to reuse a single valid transaction to mark arbitrary orders as paid and bypass payment.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Integrate PhonePe with WooCommerce	0 – through 1.2.1

Weakness: CWE-639, CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://wpscan.com/vulnerability/a1aae05d-63d0-4cde-8a9c-996f58f58e48/ exploit, vdb-entry, technical-description