CVE-2026-96173: Unknown Payments For Hubtel

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents.

Affected products

• Unknown Payments For Hubtel: before 1.0.2 (fixed in 1.0.2)

Published 2026-10-01. Last modified 2026-10-01.