CVE-2026-87843: Trust Payments Gateway for WooCommerce 0 to before 3.1.0

Affected technology

Trust Payments Gateway for WooCommerce · 0 to before 3.1.0
Vendor not specified by the source

Description’s affected range: before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from the hosted payment page

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source says the Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from the hosted payment page, nor bind that response to the targeted order or check the amount, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made, and to retrieve order and customer details. Source advisory’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality and integrity impact as low; availability impact as none.