CVE-2026-94295 in Chikkili- Google Pay India for Woocommerce Plugin
Summary
by MITRE • 10/25/2026
The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before marking the associated order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in Chikkili - Google Pay India for WooCommerce WordPress plugin versions up through 1.0.6 represents a critical failure in authentication and integrity verification mechanisms within the e-commerce transaction workflow. This flaw specifically targets the order status update process, where the application accepts payment notification payloads without validating their origin or cryptographic signature against the legitimate payment provider's credentials. By failing to verify that a payment notification actually originated from Google Pay, the plugin allows any actor with network access to inject fraudulent webhook requests into the system. This lack of source verification is a fundamental breach in secure software design principles, as it assumes trustworthiness based on endpoint accessibility rather than cryptographic proof of identity and data integrity.
From a technical perspective, this vulnerability falls under CWE-347: Improper Verification of Cryptographic Signature, which highlights the risk associated with accepting signed or unsigned messages without proper validation. The attacker can craft HTTP POST requests mimicking the structure expected by the plugin's webhook handler. Since there is no check for valid API keys, digital signatures, or IP whitelisting specific to Google Pay’s infrastructure, the application blindly processes these fabricated notifications. Consequently, the internal state of the WooCommerce order management system is manipulated directly through this unauthenticated input vector. The attacker does not need to bypass any login screens or exploit session hijacking techniques; they simply send a well-formed request that triggers the status change logic within the plugin codebase.
The operational impact of this vulnerability is severe for merchants relying on Google Pay as a payment gateway. An unauthenticated remote attacker can mark arbitrary orders in the WooCommerce database as paid without any actual funds being transferred from the customer’s account. This leads to direct financial loss through the shipment or delivery of goods and services before payment has been secured. Furthermore, it disrupts inventory management systems by falsely reducing stock levels for items that were never purchased. For businesses operating on thin margins, such fraudulent transactions can accumulate quickly, leading to significant revenue leakage and potential disputes with legitimate customers whose orders might be delayed due to resource allocation errors caused by the false paid statuses.
This behavior aligns closely with MITRE ATT&CK technique T1496: Resource Hijacking or more specifically in this context, it relates to data manipulation tactics where an adversary alters system state for malicious gain. In e-commerce environments, such vulnerabilities are often exploited as part of a broader attack chain that may include inventory depletion and financial fraud. The absence of input validation on critical business logic endpoints creates a high-severity risk profile. Security auditors should note that this is not merely a configuration error but a code-level deficiency where the developer failed to implement standard payment gateway integration security practices, such as verifying webhook signatures using shared secrets or public key infrastructure provided by the payment processor.
Mitigation strategies must focus on implementing robust verification mechanisms for all incoming webhooks and API callbacks. Developers should immediately update the plugin to version 1.0.7 or later if available, where this issue has been addressed through proper signature validation logic. In the interim, administrators can implement network-level controls such as IP whitelisting at the firewall level to restrict webhook access only to known Google Pay server addresses, although this is less secure than cryptographic verification due to potential IP rotation by providers. Additionally, integrating a secondary manual review process for high-value orders or enabling two-factor authentication for administrative actions does not directly fix the vulnerability but can mitigate some downstream risks. It is imperative that all third-party WordPress plugins handling financial transactions adhere strictly to industry standards like OWASP API Security Top 10, particularly regarding broken object level authorization and cryptographic failures, ensuring that every external input affecting business logic is rigorously authenticated and validated before processing.