blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-103329

MEDIUM 5.3 CVSS 3.1
Published
October 9, 2026
Last modified
October 9, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-347
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary WooCommerce orders as paid without payment.

Affected products and versions

  • Unknown Super Payments — Before 1.43.1

References

  • wpscan.com https://wpscan.com/vulnerability/aefba87d-fa4c-4b7c-9436-6e79e966e8a5/
  • nvd.nist.gov Official NVD record