high · CVSS v3 7.5

CVE-2026-105970

The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of incom…

Description

The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installation, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid.

Scores

Severity
high
CVSS v2
6.4
CVSS v3
7.5
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-123558

Zebra zebrad before 7.0.0 is vulnerable to a denial‑of‑service that can be triggered by a malicious peer during checkpoint synchronization. By cancelling the verifier rewind after a failed commit, an attacker can cause the node to reject legitimate blocks until it is restarted. This disrupts network availability and can stall consensus.

View analysis

high

CVE-2026-123559

Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions with many transparent inputs. Attackers can relay invalid transactions with tens of thousands of inputs, forcing quadratic ZIP-244 or ZIP-243 digest recomputation that stalls Rayon-backed block verification for minutes.

View analysis

high

CVE-2026-123560

Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync by serving a forged checkpoint block body. Attackers can supply a body with forged authorizing data near the final checkpoint, leaving rejected hashes in the sent-hash set so the node stops requesting blocks until restart.

View analysis

high

CVE-2026-123562

devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller catches the returned promise. An attacker able to influence the timing or failure of serialized asynchronous values can terminate the Node.js process.

View analysis