blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-103299

MEDIUM 5.3 CVSS 3.1
Published
October 26, 2026
Last modified
October 30, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-287
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the secret has not been set, and the same callback lets them move any pending order to a failed state whether or not the secret is configured.

Affected products and versions

  • Unknown Payment Gateway — Up to and including 2.2.0

References

  • wpscan.com https://wpscan.com/vulnerability/0a1c3070-181d-49ea-9488-d0d7e4be419c/
  • nvd.nist.gov Official NVD record