{"id":"CVE-2026-88928","revision":"7846a7be853a4d81b75343ffeb6639f2","records":[{"revision":"7846a7be853a4d81b75343ffeb6639f2","observedAt":"2026-10-29T12:12:12.337+00:00","statement":{"source":"cve-program","id":"CVE-2026-88928","aliases":[],"title":"PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification Bypass","description":"The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwrite the stored payment token associated with existing orders and delete saved card records.","state":0,"publishedAt":"2026-10-29T06:00:23.147+00:00","modifiedAt":"2026-10-29T10:56:08.43+00:00","affected":[{"ecosystem":"Vendor product","name":"PAYCOMET for WooCommerce","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"PAYCOMET for WooCommerce\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"5.36\",\n                            \"lessThan\": \"5.46\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/aa7b4a44-9584-47e5-b3a1-1dcf876a86e4/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-88928","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-88928","identifiers":["CVE-2026-88928"]},"retained":false,"historicalAffected":[]}],"coverage":[]}