CVE-2026-106027

MediumCVSS 5.3/10Last modified Nov 12, 2026

Description

The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Unknown	Oxygen MyData for WooCommerce	>= 3.0.0, < 3.0.9

References

https://wpscan.com/vulnerability/6f364114-e016-4c60-9ced-5b726d84bc19/

Timeline

Published: Nov 12, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1060285.3The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons,CVE-2026-1060297.5The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and CVE-2026-1060306.8NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pip CVE-2026-1060316.5The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consu CVE-2026-1060325.7Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit b CVE-2026-1060335.4A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the applicat CVE-2026-1060345.0A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary CVE-2026-1060355.5An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated a CVE-2026-1060366.9Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without a CVE-2026-1060379.8Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without auth CVE-2026-1060388.2Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-de CVE-2026-1060396.5Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, s