VulnSocial

CVE-2026-84043Disclosure

LOWCVSS 5.3 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signature.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-345

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-04); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-04: 1Mentions · 2026-09-14: 1PoC Mentioned / Linked · 2026-09-14: 1Patch / Workaround · 2026-09-14: 1Technical Details · 2026-09-04: 109-0409-14
Signal classification2 categories
Disclosure
150.0%
PoC
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-041
Disclosure1
2026-09-141
PoC1
Full discourse2 posts
  • Phil_Taboada@Phil24275443
    PoC

    Si cobras con ePayco en WooCommerce, actualiza a 8.4.7. Podían marcar pedidos como pagados sin que el dinero entre. PoC el 16 set. Si no, despachas sin cobrar. https://www.wavys-technologies.com/es/blog/epayco-woocommerce-cve-2026-84043

    Post summary

    The tweet announces a PoC for CVE‑2026‑84043 and urges users to update the ePayco WooCommerce plugin to version 8.4.7 to remediate the issue where orders can be marked as paid without payment.

    0000045
    3 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-84043 The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthen… https://www.cve.org/CVERecord?id=CVE-2026-84043

    Post summary

    The ePayco Payment Gateway for WooCommerce plugin before version 8.4.7 fails to verify payment confirmation authenticity, exposing a vulnerability that could be exploited to manipulate payments.

    000001.0K
    58.1K followersView on X

Explore more

Back to dashboard