Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount, allowing unauthenticated attackers to mark arbitrary orders as paid without payment.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-16738 The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed p… https://www.cve.org/CVERecord?id=CVE-2026-16738
Post summary
The post discloses that the Conekta Payment Gateway WordPress plugin versions prior to 6.2.2 are vulnerable due to lack of verification for incoming webhook notifications, pointing to CVE-2026-16738.
CVE-2026-16738 Conekta Payment Gateway WordPress Plugin Allows Falsifying Payments https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-16738
Post summary
The post discloses CVE‑2026‑16738, highlighting that the Conekta Payment Gateway WordPress Plugin can falsify payments, but contains no PoC, exploit, active exploitation, or patch information.