Live › vulnerability › CVE-2026-103298
Go to dashboardThe CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not check that payment confirmations come from CCAvenue, and its verification key is empty on a default install. An unauthenticated attacker can forge a confirmation and mark any WooCommerce order as paid without paying.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 07:28 UTC. All times on this page are UTC.
Stores running WooCommerce with the CCAvenue Payment Gateway plugin version 3.1 or earlier are exposed, since the confirmation endpoint trusts requests without verifying them and the default key is empty. Stores that do not use this plugin, or that have set a non-empty key and verified the confirmation path, are less exposed. The sources do not say whether the plugin's confirmation endpoint is reachable on every install.
No product ranges from the sources yet.
3.1; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install, allowing unauthenticated attackers to forge a confirmation and mark any WooCommerce order as paid without payment.
This page as .md · .json · in your agent: get_signal("CVE-2026-103298")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.