{"metadata": {"vulnerability": "CVE-2026-81649", "count": 14, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-08-27T09:27:23.244Z", "date_only": false, "value": "2026-08-27T09:27:23.244Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-81649", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-11T06:00:11.335Z", "date_only": false, "value": "2026-10-11T06:00:11.335Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-81649", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-11T06:00:11.335Z", "date_only": false, "value": "2026-10-11T06:00:11.335Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / WPScan", "record": "CVE-2026-81649", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-11T06:37:27.629Z", "date_only": false, "value": "2026-10-11T06:37:27.629114Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117420893617325568", "record": "CVE-2026-81649", "field": "creation_timestamp", "uuid": "e9ebfcb7-e3f9-4ab7-9d7c-aa081aedd950", "content": "CVE-2026-81649 Fundiin <= 3.4.0 - Unauthenticated Payment Gateway Settings Update and Credential Disclosure The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer order data, overwrite the payment gateway configuration so that payments are credited elsewhere, and mark unpaid orders as paid. The same missing authorisation also allows arbitrary script to be stored in a field which is output unescaped on the classic checkout, leading to unauthenticated stored XSS on stores that do not use the block-based checkout.\nhttps://www.cve.org/CVERecord?id=CVE-2026-81649https://wpscan.com/vulnerability/28cec871-1f17-48c7-b836-db705fc5cffa/#CVE_2026_81649#bot", "url": "https://infosec.exchange/users/cve/statuses/117420893617325568"}, {"timestamp": "2026-10-11T07:17:24Z", "date_only": false, "value": "2026-10-11T07:17:24Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-V54W-6HQG-RX6F", "record": "GHSA-V54W-6HQG-RX6F", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-11T07:17:24.703Z", "date_only": false, "value": "2026-10-11T07:17:24.703", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-81649", "record": "FKIE_CVE-2026-81649", "field": "published"}, {"timestamp": "2026-10-11T09:30:24Z", "date_only": false, "value": "2026-10-11T09:30:24Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-V54W-6HQG-RX6F", "record": "GHSA-V54W-6HQG-RX6F", "field": "published"}, {"timestamp": "2026-10-11T11:26:44.703Z", "date_only": false, "value": "2026-10-11T11:26:44.703774Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-81649", "field": "containers.adp.0.metrics.1.other.content.timestamp"}, {"timestamp": "2026-10-11T11:26:44.703Z", "date_only": false, "value": "2026-10-11T11:26:44.703774Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-81649", "record": "FKIE_CVE-2026-81649", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-11T11:32:45.826Z", "date_only": false, "value": "2026-10-11T11:32:45.826Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-81649", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-11T11:32:45.826Z", "date_only": false, "value": "2026-10-11T11:32:45.826Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-81649", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-11T12:10:05.800Z", "date_only": false, "value": "2026-10-11T12:10:05.800823Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxlxv57nvo2z", "record": "CVE-2026-81649", "field": "creation_timestamp", "uuid": "6f7c8470-f055-4641-a47f-4aa3870737f9", "content": "CVE-2026-81649 - fundiin cho woocommerce\nThe Fundiin plugin for WooCommerce on WordPress (versions up to 3.4.0) does not properly check who is making changes through its API, using the same default password on every\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#unknown #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxlxv57nvo2z"}, {"timestamp": "2026-10-11T12:31:07Z", "date_only": false, "value": "2026-10-11T12:31:07Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-V54W-6HQG-RX6F", "record": "GHSA-V54W-6HQG-RX6F", "field": "modified"}, {"timestamp": "2026-10-13T20:36:00.850Z", "date_only": false, "value": "2026-10-13T20:36:00.850", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-81649", "record": "FKIE_CVE-2026-81649", "field": "lastModified"}]}