PatchSiren cyber security CVE debrief

CVE-2026-105975 CamPay Shortcode Payment Gateway CVE debrief

The CamPay Shortcode Payment Gateway plugin for WordPress, versions before 1.7, is vulnerable to unauthenticated payment status forgery. This vulnerability allows attackers to mark payment records as paid, destroy genuine payment records, and write plugin metadata onto arbitrary posts. The vulnerability was reported by WPScan and documented in the CVE Program record and NVD vulnerability detail page. Defenders responsible for WordPress installations with the CamPay Shortcode Payment Gateway plugin, version 1.6 or earlier, should assess exposure and prioritize verification and remediation to prevent financial losses, accounting discrepancies, and data tampering.

Vendor: CamPay Shortcode Payment Gateway
Product: CamPay Shortcode Payment Gateway
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-14
Original CVE updated: 2026-10-14
Advisory published: 2026-10-14
Advisory updated: 2026-10-14

Who should care

Defenders responsible for WordPress installations with the CamPay Shortcode Payment Gateway plugin, version 1.6 or earlier, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-105975 allows unauthenticated attackers to manipulate payment records and write metadata onto arbitrary posts in WordPress installations with the CamPay Shortcode Payment Gateway plugin, version 1.6 or earlier. Defenders should prioritize verification and remediation to prevent financial losses, accounting discrepancies, and data tampering.

Unauthenticated payment status forgery can lead to financial losses
Destruction of genuine payment records can cause accounting discrepancies
Writing plugin metadata onto arbitrary posts can result in data tampering

Technical summary

The CamPay Shortcode Payment Gateway plugin for WordPress does not verify the authenticity of Mobile Money payment confirmations, allowing unauthenticated attackers to manipulate payment records and write metadata onto arbitrary posts. This vulnerability can lead to financial losses, accounting discrepancies, and data tampering. Defenders should prioritize verifying the authenticity of payment confirmations and restrict access to payment status updates to prevent exploitation. The vulnerability was reported by WPScan and documented in the CVE Program record and NVD vulnerability detail page.

Defensive priority

Defenders should prioritize verifying the authenticity of payment confirmations and restrict access to payment status updates.

Recommended defensive actions

Verify the authenticity of Mobile Money payment confirmations
Restrict access to payment status updates
Monitor for suspicious payment activity
Update to version 1.7 or later
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was reported by WPScan and documented in the CVE Program record and NVD vulnerability detail page. The CamPay Shortcode Payment Gateway plugin for WordPress does not verify the authenticity of Mobile Money payment confirmations, allowing unauthenticated attackers to manipulate payment records and write metadata onto arbitrary posts. WPScan provided details on the vulnerability, which were verified through the CVE Program and NVD.

Sources and references

Verified primary and authoritative sources

CVE-2026-105975 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-105975

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-105975 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-105975

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

CamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forgery via external_ref
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105975.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://wpscan.com/vulnerability/a5da90f5-563d-4397-b3bc-38bd1dc9aefb/

Supplemental source - exploit, vdb-entry, technical-description

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.