Asaas CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review Asaas CVE published 2026-10-14

CVE-2026-87974

The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, allowing unauthenticated attackers to mark arbitrary orders as paid. This vulnerability can lead to financial impacts and requires defenders to verify and update affected systems. The plugin's default configuration accepts an empty access token, and it does not verify that the confirmed paym [truncated]