WordPress plugin
payever Checkout – Composable Payment Gateway security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical1
- High1
- Medium0
- Low0
All payever Checkout – Composable Payment Gateway vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Critical9.8 | Unauthenticated Arbitrary File Upload Leading to Remote Code Execution ≤4.8.0Update to 4.9.0 | CVE-2026-93754 | |
| High8.1 | Unauthenticated PHP Object Injection ≤4.8.2No patch available | CVE-2026-42716 |
- Critical9.8Unauthenticated Arbitrary File Upload Leading to Remote Code Execution
≤4.8.0Update to 4.9.0
- High8.1Unauthenticated PHP Object Injection
≤4.8.2No patch available
payever Checkout – Composable Payment Gateway: common questions
Does payever Checkout – Composable Payment Gateway have known vulnerabilities?
Yes. VulnCrest Radar lists 2 known vulnerabilities in payever Checkout – Composable Payment Gateway: 1 critical, 1 high. At least one is not fixed in the latest version.
How do I check which version of payever Checkout – Composable Payment Gateway I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent payever Checkout – Composable Payment Gateway vulnerability?
CVE-2026-93754, published Nov 6, 2026: payever – WooCommerce Gateway <= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution. Severity: Critical (CVSS 9.8).
Is any payever Checkout – Composable Payment Gateway vulnerability listed in CISA KEV?
No. None of the known payever Checkout – Composable Payment Gateway vulnerabilities is currently listed in the CISA KEV catalog.