blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-103327

MEDIUM 5.3 CVSS 3.1
Published
November 3, 2026
Last modified
November 4, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-345
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthenticated attackers to mark arbitrary orders as paid or failed without any payment being made.

Affected products and versions

  • Unknown CryptoCloud — From 3.0.0 (including) to 3.0.1 (including)

References

  • wpscan.com https://wpscan.com/vulnerability/fd5563ed-85c6-4b17-acf6-bdc2cd77dd4b/
  • nvd.nist.gov Official NVD record