{"id":"CVE-2026-103298","kind":"vulnerability","aliases":["CVE-2026-103298"],"related":[],"title":"CCAvenue WooCommerce plugin: forged payment confirmations mark unpaid orders paid","description":"The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install, allowing unauthenticated attackers to forge a confirmation and mark any WooCommerce order as paid without payment.","summary":"The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not check that payment confirmations come from CCAvenue, and its verification key is empty on a default install. An unauthenticated attacker can forge a confirmation and mark any WooCommerce order as paid without paying.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","payments","woocommerce","wordpress"],"not_affected_if":["non-default-key-set","plugin-not-installed"],"how_to_check":"- Check whether the CCAvenue Payment Gateway for WooCommerce plugin is installed and what version it is, in the WordPress admin under Plugins.\n- Check the plugin's working key or verification setting in the WooCommerce payment gateway settings for an empty value; the sources do not name the exact field.","fix":"- Update the CCAvenue Payment Gateway for WooCommerce plugin to a version later than `3.1`; the sources do not name a fixed version.\n- Set a non-empty verification key in the plugin settings if the update is not yet available; the sources do not name the setting.","status":"open","published_at":"2026-10-26T07:17:06+00:00","first_seen_at":"2026-10-26T07:28:49+00:00","triaged_at":"2026-10-26T07:30:07+00:00","updated_at":"2026-10-26T07:30:07+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T07:30:07Z","model":"claude-haiku-5-5","output":{"fix":"- Update the CCAvenue Payment Gateway for WooCommerce plugin to a version later than `3.1`; the sources do not name a fixed version.\n- Set a non-empty verification key in the plugin settings if the update is not yet available; the sources do not name the setting.","reach":"internet","title":"CCAvenue WooCommerce plugin: forged payment confirmations mark unpaid orders paid","impact":"medium","summary":"The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not check that payment confirmations come from CCAvenue, and its verification key is empty on a default install. An unauthenticated attacker can forge a confirmation and mark any WooCommerce order as paid without paying.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","ecommerce","payments"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker marks any WooCommerce order paid without paying.","analyst_note":"Check the NVD entry and the plugin's changelog for the fixed version and the exact key setting that is empty by default; sources give no CVSS or fix.","how_to_check":"- Check whether the CCAvenue Payment Gateway for WooCommerce plugin is installed and what version it is, in the WordPress admin under Plugins.\n- Check the plugin's working key or verification setting in the WooCommerce payment gateway settings for an empty value; the sources do not name the exact field.","needs_analyst":true,"not_affected_if":["plugin-not-installed","non-default-key-set"],"who_is_affected":"Stores running WooCommerce with the CCAvenue Payment Gateway plugin version 3.1 or earlier are exposed, since the confirmation endpoint trusts requests without verifying them and the default key is empty. Stores that do not use this plugin, or that have set a non-empty key and verified the confirmation path, are less exposed. The sources do not say whether the plugin's confirmation endpoint is reachable on every install.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":3331,"output_tokens":727,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-103298':13A,16A '-2026':12A,15A '3.1':31B,76C 'allow':107C 'attack':53B,109C 'ccavenu':1A,23B,40B,68C 'check':34B 'come':38B 'confirm':6A,37B,57B,84C,113C 'cve':11A,14A 'default':49B,105C 'deriv':93C 'ecommerc':17B 'empti':46B,102C 'forg':4A,55B,111C 'gateway':25B,70C 'genuin':86C 'instal':50B,106C 'key':44B,96C 'mark':7A,59B,115C 'order':9A,62B,118C 'origin':87C 'packag':18B 'paid':10A,64B,120C 'pay':66B 'payment':5A,19B,24B,36B,69C,83C,90C,122C 'payment-confirm':82C 'plugin':3A,29B,74C 'provid':91C 'request':85C 'unauthent':52B,108C 'unpaid':8A 'valu':99C 'verif':43B,95C 'verifi':79C 'without':65B,121C 'woocommerc':2A,20B,27B,61B,72C,117C 'wordpress':21B,28B,73C","nicknames":[],"mitigations":[],"who_affected":"Stores running WooCommerce with the CCAvenue Payment Gateway plugin version 3.1 or earlier are exposed, since the confirmation endpoint trusts requests without verifying them and the default key is empty. Stores that do not use this plugin, or that have set a non-empty key and verified the confirmation path, are less exposed. The sources do not say whether the plugin's confirmation endpoint is reachable on every install.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T07:17:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103298","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103298","severity":null,"published_at":"2026-10-26T07:17:06+00:00","modified_at":"2026-10-26T07:17:06+00:00","first_seen_at":"2026-10-26T07:28:49+00:00","fetched_at":"2026-10-26T07:28:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}