Chikkili Google Pay: Forged payment notifications mark orders paid
Chikkili Google Pay India for WooCommerce through 1.0.6 accepts payment notifications without verifying that they came from the payment provider. An unauthenticated attacker can submit a forged notification and mark an arbitrary order paid without making a payment. The notification endpoint, parameter names and expected verification method are not disclosed in the export. Published affected versions: <= 1.0.6.
- Component
- Chikkili- Google Pay India for Woocommerce
- Plugin slug
chikkili-google-pay-for-woocommerce- Affected
- <= 1.0.6
- Safe version
- See mitigation notes
- Published
- Oct 25, 2026
- Weakness
- Not assigned
This CVE was published Oct 25, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
This archive could not verify a fixed release: the official plugin listing and release notes were unavailable when checked on 2026-10-26. This is an evidence limitation, not a claim that the vendor has not fixed the issue. Disable the affected payment-notification path until remediation is established. Verify payment origin and reconcile the order, amount and currency against the provider before marking an order paid or fulfilling it. Review paid orders against provider records. Official release-note location: https://wordpress.org/plugins/chikkili-google-pay-for-woocommerce/#developers.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before marking the associated order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made.