CVE-2026-103299

MediumCVSS 5.3/10Last modified Oct 30, 2026

Description

The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the secret has not been set, and the same callback lets them move any pending order to a failed state whether or not the secret is configured.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Oct 26, 2026
Last modified: Oct 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1033005.3The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely origin CVE-2026-1033015.3The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because th CVE-2026-1033025.3The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the CVE-2026-1033038.8The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its settings, and does n CVE-2026-1033045.3The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJA CVE-2026-1033058.8The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape so CVE-2026-1033065.3The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callb CVE-2026-1033078.6The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it CVE-2026-1033086.5The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on CVE-2026-1033097.5The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when output CVE-2026-1033105.3The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the mer CVE-2026-1033115.3The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment we