Vulnerability · Published Oct 29, 2026 · Assigned by WPScan
CVE-2026-88928PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification Bypass
Medium 6.5
In plain English
A medium-severity improper authentication in PAYCOMET for WooCommerce from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 94.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwrite the stored payment token associated with existing orders and delete saved card records.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | PAYCOMET for WooCommerce | 5.36 – before 5.46 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://wpscan.com/vulnerability/aa7b4a44-9584-47e5-b3a1-1dcf876a86e4/ exploit, vdb-entry, technical-description