CVE-2026-103325

LowCVSS 3.7/10Last modified Oct 28, 2026

Description

The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid on web servers that preserve request header case.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
Unknown	TiendaCrypto para WooCommerce	>= 1.0.1, <= 1.2.1

References

https://wpscan.com/vulnerability/d19c174c-0032-4f5d-b9be-c4f690e4c8ca/

Timeline

Published: Oct 27, 2026
Last modified: Oct 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1033275.3The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gate CVE-2026-1033295.3The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as th CVE-2026-1033305.3The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the veri CVE-2026-1033315.3The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not properly verify the authenticity of payment notifications, a CVE-2026-1033325.3The Payex Payment Gateway for Woocommerce WordPress plugin through 1.2.10 does not properly verify the authenticity of incoming payment noti CVE-2026-1033347.5Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations restaura CVE-2026-1033355.3Insertion of Sensitive Information Into Sent Data vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-z CVE-2026-1033365.3Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate-csv-importer allows CVE-2026-1033376.5Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Contro CVE-2026-1033388.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements CVE-2026-1033396.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet Metform metform allows Stored XS CVE-2026-1033405.3Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Securit