---
id: "CVE-2026-103298"
kind: "vulnerability"
aliases: ["CVE-2026-103298"]
title: "CCAvenue WooCommerce plugin: forged payment confirmations mark unpaid orders paid"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "package", "payments", "woocommerce", "wordpress"]
not_affected_if: ["non-default-key-set", "plugin-not-installed"]
published_at: "2026-10-26T07:17:06+00:00"
first_seen_at: "2026-10-26T07:28:49+00:00"
updated_at: "2026-10-26T07:30:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103298", "first_seen_at": "2026-10-26T07:28:49+00:00"}]
---

# CCAvenue WooCommerce plugin: forged payment confirmations mark unpaid orders paid

The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not check that payment confirmations come from CCAvenue, and its verification key is empty on a default install. An unauthenticated attacker can forge a confirmation and mark any WooCommerce order as paid without paying.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the CCAvenue Payment Gateway for WooCommerce plugin is installed and what version it is, in the WordPress admin under Plugins.
- Check the plugin's working key or verification setting in the WooCommerce payment gateway settings for an empty value; the sources do not name the exact field.

## Fix

- Update the CCAvenue Payment Gateway for WooCommerce plugin to a version later than `3.1`; the sources do not name a fixed version.
- Set a non-empty verification key in the plugin settings if the update is not yet available; the sources do not name the setting.

## Timeline

- 2026-10-26T07:28:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103298

## From the sources

The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install, allowing unauthenticated attackers to forge a confirmation and mark any WooCommerce order as paid without payment.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_