CVE-2026-103359

MediumCVSS 5.3/10Last modified Oct 28, 2026

Description

The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming payment notifications and, until the gateway is configured, authenticates them with a value derived from an empty secret that anyone can compute, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid and completed.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-345

Affected software

Vendor	Product	Versions
Unknown	PayDunya WooCommerce Payment Gateway	>= 1.1.6, <= 1.1.6

References

https://wpscan.com/vulnerability/d2d7c885-9525-41e0-9666-04a4a8cd183f/

Timeline

Published: Oct 27, 2026
Last modified: Oct 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1033606.5IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation CVE-2026-1033655.3The Bookly – Online Scheduling and Appointment Booking System plugin for WordPress is vulnerable to Sensitive Information Exposure in versio CVE-2026-1033667.5The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Objec CVE-2026-1033678.1The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and includi CVE-2026-1033696.4The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'respon CVE-2026-1033706.4The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpas_fi CVE-2026-1033717.5Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache Geode: from 2.0.0 before 2.0.3 CVE-2026-1033725.3The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning its confirmation link,CVE-2026-1033755.3The Antom Payments WordPress plugin through 2.0.11 does not perform any ownership or authorisation check before returning an order's confirm CVE-2026-1033765.3The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.1 CVE-2026-1033775.1A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the web application of the Castile-La Mancha Regional Parliament CVE-2026-1033786.5The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its