CamPay Shortcode Payment Gateway
CamPay Shortcode Payment Gateway has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.
The most common weakness is Insufficient Verification Of Data Authenticity, behind 1 of the records (100%).
The one issue recorded for CamPay Shortcode Payment Gateway has a vendor fix available, so running the current release closes it.
All of these findings were reported by Pablo González Pérez. CamPay Shortcode Payment Gateway is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-105975CamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Arbitrary Payment Status Manipulation
Read the full analysisVulnerability Records

CamPay Shortcode Payment Gateway
Author
campay
CamPay is a Cameroonian fintech service of TAKWID GROUP, running since January 2021. It lets businesses and organisations collect and send money online, mainly through MTN Mobile Money and Orange Money. With this plugin you do not need a shop or a donation plugin: place the [campay] shortcode in any page or post and your visitors can pay you, for a fixed amount or an amount they choose. How visitors pay Mobile Money: the visitor clicks the button, enters their MTN or Orange number and approves the payment on their phone. The payment window shows the instructions, a countdown and the result live. No prompt? They can dial 126# (MTN) or #15050# (Orange) to approve pending payments. Debit or credit card: the visitor chooses “Debit or credit card”, pays on a secure CamPay page and comes back to your success or failure page. Cards are only offered when you enable them and card payments are activated on your CamPay account. Features One shortcode, as many buttons as you want on the same page Fixed amounts, or visitor-entered amounts with suggested amounts and limits MTN Mobile Money and Orange Money with operator detection, and debit or credit cards Optional extra field saved with each payment (room number, invoice number, full name…) Amounts in FCFA (XAF), US dollars or euros; USD and EUR are converted to XAF with your own rates Default “Payment successful” and “Payment not completed” pages, created on activation, with a receipt of the payment Payments list with totals, status, filters, search, CSV export and a details page Pending payments are re-checked automatically, and the webhook records late confirmations Every card return and webhook is checked with the CamPay signature and verified with the CamPay API Shortcode builder, connection test, demo mode, dashboard widget Real CamPay API errors in the logs and on each payment, visible to administrators only Shortcode attributes Every attribute is optional; missing ones use the defaults of CamPay > Settings > Payment form. amount: fixed amount. Leave it out to let the visitor enter the amount amounts: comma-separated suggested amounts, e.g. amounts="1000,2000,5000" min_amount / max_amount: limits for visitor-entered amounts currency: XAF (default), or USD / EUR when their conversion rate is enabled product_title: what the payment is for, shown in the payment window and the payments list product_ref: your own reference button_text: text of the button success_url / failure_url: pages to open after a successful or failed payment extra_label / extra_required: optional extra text field class: extra CSS class for the button Examples: [campay amount="2000" product_title="Membership" button_text="Pay"] [campay product_title="Donation" amounts="1000,5000,10000" button_text="Donate"] [campay_payment_status] shows the receipt of the payment the visitor just made. It is already on the default result pages. External services This plugin connects to the CamPay API (https://campay.net, or https://demo.campay.net in Demo mode) to process payments. It is required for the plugin to work. Authentication: when a payment is started, a status is checked, card availability is checked or you click “Test connection”, your App Username and App Password are sent to get an access token. Card availability: on pages with a payment button, and in the settings, when card payments are enabled the plugin asks CamPay whether cards are activated on your account (the answer is cached for up to an hour). Mobile Money payment: when a visitor submits the payment window, the amount in XAF, the visitor’s phone number, the payment title and reference, and a unique reference are sent. The payment status is then checked until it is confirmed, and pending payments are re-checked in the background. Card payment: when a visitor chooses to pay by card, the amount in XAF, the payment title and reference, a unique reference and the return address on your site are sent to create the payment page. The visitor enters card details on the CamPay page, not on your site. Verification: when the visitor comes back from the card page or CamPay calls the webhook, the transaction is fetched from CamPay to confirm it. CamPay is provided by TAKWID GROUP: terms and conditions, privacy policy. API documentation: CamPay API.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C