blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-103325

LOW 3.7 CVSS 3.1
Published
October 27, 2026
Last modified
October 28, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-347
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid on web servers that preserve request header case.

Affected WordPress components

  • TiendaCrypto para WooCommerce Plugin · tienda-crypto-woo
    Possible match Abandoned
    From 1.0.1 (including) to 1.2.1 (including)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown TiendaCrypto para WooCommerce — From 1.0.1 (including) to 1.2.1 (including)

References

  • wpscan.com https://wpscan.com/vulnerability/d19c174c-0032-4f5d-b9be-c4f690e4c8ca/
  • nvd.nist.gov Official NVD record