Paymentfor Gateway for WooCommerce

Paymentfor Gateway for WooCommerce has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of November 2026. Their average CVSS score is 7.3, and the most serious one scores 7.3 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Insufficient Verification Of Data Authenticity, behind 1 of the records (100%).

The one issue recorded for Paymentfor Gateway for WooCommerce has a vendor fix available, so running the current release closes it.

All of these findings were reported by Enrico Marcolini. Paymentfor Gateway for WooCommerce is installed on roughly 90 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.4.

Strategic Overview

Avg CVSSHigh
7.3/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Paymentfor Gateway for WooCommerce vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.3CVE-2026-94360

Paymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Arbitrary Order Status Manipulation

Read the full analysis

Vulnerability Records

1 records
Plugin Profile
Latestv1.0.6

Paymentfor Gateway for WooCommerce

paymentfor

Author

paymentfor

0.0(0)
0/100
Last Updated
2026-10-06 (29d ago)
Active Installs
90+
Downloads
1,526
Requires WP
5.6+
Requires PHP
7.4+
Tested up to
WP 7.1.4
Created
2026-01-15 (10mo ago)
Requires Plugins
woocommerce

Paymentfor Gateway for WooCommerce is a free plugin that integrates Payment for, Inc. payment services with WooCommerce, enabling secure acceptance of multiple payment methods. To use this plugin, you must have an active merchant account with Payment for, Inc. The plugin operates in compliance with PCI DSS standards and supports EMV 3-D Secure 2.0 authentication for enhanced security. Supported payment methods include credit card payments (non-pass-through token-based or link-based), convenience store online payments, and PayPay mobile wallet payments. Recurring subscription payments are supported through the WooCommerce Subscriptions plugin. Minimum Requirements WordPress 5.6 or newer. PHP 7.4 or newer. WooCommerce 3.0 or newer. WooCommerce Subscriptions tested up to 9.2 (for subscription payments). SSL certificate required (SHA2 algorithm, TLS 1.2 only). Merchant account with Payment for, Inc. Build Process This plugin includes minified JavaScript files in the build/ directory for the block-based checkout functionality. These files are generated using @wordpress/scripts and webpack. The source files for the block checkout are developed using React and modern JavaScript, then compiled into the production-ready files you see in the build/ directory. Build dependencies: – Node.js and npm – @wordpress/scripts package If you need to rebuild the JavaScript files from source, you would need to set up a Node.js development environment with @wordpress/scripts. However, for normal plugin use, this is not necessary as the compiled files are included. Setup Before using this plugin, you must have an active merchant account with Payment for, Inc. Contact Payment for, Inc. at https://www.paymentfor.com/ to apply. Once approved, you will receive an IP Code and IP Password required for configuration. To configure each payment method, go to WooCommerce > Settings > Payments and click Manage for the desired payment method. Enter your credentials and configure the settings as needed. Save your changes. For convenience store and PayPay payments, you must register payment notification URLs with Payment for, Inc. to receive payment confirmations. The required URLs are displayed in the payment settings. Payment Processing All payment operations (sales confirmation, cancellation, refund) must be performed through the WooCommerce order management interface, not through the Payment for, Inc. merchant dashboard. Performing operations outside of WooCommerce may cause synchronization failures. Do not delete order records before completing payment adjustments, as this will prevent WooCommerce from processing payment modifications. If an order is deleted, contact Payment for, Inc. merchant support for transaction adjustments. Testing Verify all payment settings are configured correctly before testing. Obtain test card numbers from the Payment for, Inc. merchant dashboard. Complete test purchases using the test cards and verify transactions appear in the Payment for, Inc. merchant dashboard. Test payment operations including sales confirmation and cancellation. If testing with real cards, always cancel the test transaction afterward. Important Notes SSL certificate installation is mandatory. Signature algorithm must be SHA2 and communication protocol must be TLS 1.2 only (TLS 1.3 not supported). Contact your hosting provider for SSL configuration verification. This plugin complies with PCI DSS standards. Credit card information is never stored on your server. It is securely transmitted and stored only in Payment for, Inc. systems. For convenience store and PayPay payments, payment completion notifications are only received if notification URLs are properly registered with Payment for, Inc. External Services This plugin connects to Payment for, Inc.’s payment gateway services to process payments. This connection is required for the plugin to function. Service Provider: Payment for, Inc. Website: https://www.paymentfor.com/ What data is sent: – Transaction information (order ID, transaction code, amount, product names) – Customer information (name, address, email, phone number) – Payment information (credit card details are transmitted directly to Payment for’s secure servers and never stored on your site) When data is sent: – When a customer completes checkout using Payment for payment methods – When processing payment confirmations, cancellations, or refunds – When checking payment status or user ID information API Endpoints Used: This plugin connects to Payment for, Inc.’s secure payment processing servers. Specific endpoint details are provided in the technical documentation. Terms and Privacy: – Privacy Policy: https://www.paymentfor.com/etc/privacy – Terms of Service: https://www.paymentfor.com/etc/agreement Please refer to Payment for, Inc.’s privacy policy and terms of service for details on how they handle your data. For more information about Payment for, Inc.’s services and data handling practices, please visit their website or contact their support team. Support For technical support, contact Welcart Inc. at https://www.welcart.com/ For merchant account questions, contact Payment for, Inc. at https://www.paymentfor.com/

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C