Live › vulnerability › CVE-2026-103299
Go to dashboardThe Payment Gateway WordPress plugin through 2.2.0 does not require its shared secret to be set before using it to verify bank payment notifications. Unauthenticated attackers can forge a notification to mark any WooCommerce order as paid on sites where the secret is unset, and can move any pending order to failed whether or not the secret is set.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 07:28 UTC. All times on this page are UTC.
Sites running the Payment Gateway WordPress plugin version 2.2.0 or earlier with WooCommerce are exposed, and the risk is greatest where the shared secret was never configured. The callback accepts unauthenticated requests, so the site does not need an account for an attacker to reach it. Sites on a fixed version, or using a different payment gateway, can skip this.
No product ranges from the sources yet.
wp plugin get <plugin-slug> --field=version or in the WordPress admin Plugins screen; versions through 2.2.0 are affected.2.2.0; the fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the secret has not been set, and the same callback lets them move any pending order to a failed state whether or not the secret is configured.
This page as .md · .json · in your agent: get_signal("CVE-2026-103299")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.