CamPay Shortcode Payment Gateway < 1.7 — Unauthenticated Arbitrary Payment Status Manipulation

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under CamPay Shortcode Payment Gateway.
• No admin access? Run a passive check of your site. It reads public files only.
• No account is needed to exploit this. Treat any exposed site on an affected version as at risk.

What to do

1. Update to version 1.7, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch CamPay Shortcode Payment Gateway to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Pablo González Pérez, Francisco José Ramírez Vicente, Iñigo Sánchez Enciso.

The CamPay Shortcode Payment Gateway plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to 1.7. This is due to missing server-side verification of payment status in the validate_payment() callback handler, which accepted the payment outcome directly from client-supplied GET parameters without verifying the response against the CamPay API or validating a cryptographic signature. This makes it possible for unauthenticated attackers to unauthenticated attackers to mark arbitrary payment records as paid, corrupt genuine payment records, and write post meta onto arbitrary post IDs by supplying a forged status value in the callback URL.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Timeline

1. Oct 14, 2026

   CVE published

   Severity medium, CVSS 5.3

2. Nov 13, 2026

   Record last updated