{"id":"CVE-2026-103299","kind":"vulnerability","aliases":["CVE-2026-103299"],"related":[],"title":"Payment Gateway WordPress plugin lets attackers mark WooCommerce orders paid","description":"The Payment Gateway  WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the secret has not been set, and the same callback lets them move any pending order to a failed state whether or not the secret is configured.","summary":"The Payment Gateway WordPress plugin through 2.2.0 does not require its shared secret to be set before using it to verify bank payment notifications. Unauthenticated attackers can forge a notification to mark any WooCommerce order as paid on sites where the secret is unset, and can move any pending order to failed whether or not the secret is set.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","payments","self-hosted","woocommerce","wordpress"],"not_affected_if":["newer-version","other-payment-gateway","plugin-not-installed"],"how_to_check":"- Confirm the installed plugin version with `wp plugin get <plugin-slug> --field=version` or in the WordPress admin Plugins screen; versions through `2.2.0` are affected.\n- In the plugin's gateway settings, check whether the shared secret field is empty.\n- Review the plugin's payment-notification callback endpoint in web server logs for unexpected requests.","fix":"- Update the Payment Gateway plugin to a version later than `2.2.0`; the fixed version is unknown from the sources.\n- Set a strong shared secret in the plugin's gateway settings until the update is applied.\n- Audit recently changed WooCommerce orders for payments that did not reach the bank.","status":"open","published_at":"2026-10-26T07:17:06+00:00","first_seen_at":"2026-10-26T07:28:49+00:00","triaged_at":"2026-10-26T07:30:11+00:00","updated_at":"2026-10-26T07:30:11+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-26T07:30:11Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Payment Gateway plugin to a version later than `2.2.0`; the fixed version is unknown from the sources.\n- Set a strong shared secret in the plugin's gateway settings until the update is applied.\n- Audit recently changed WooCommerce orders for payments that did not reach the bank.","reach":"internet","title":"Payment Gateway WordPress plugin lets attackers mark WooCommerce orders paid","impact":"medium","summary":"The Payment Gateway WordPress plugin through 2.2.0 does not require its shared secret to be set before using it to verify bank payment notifications. Unauthenticated attackers can forge a notification to mark any WooCommerce order as paid on sites where the secret is unset, and can move any pending order to failed whether or not the secret is set.","category":"other","nicknames":[],"who_cares":["wordpress","woocommerce","payments","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attackers mark unpaid WooCommerce orders as paid without paying","analyst_note":"Find the patched version of Payment Gateway after 2.2.0 and the plugin's changelog, using the NVD entry CVE-2026-103299 and the WordPress.org plugin page.","how_to_check":"- Confirm the installed plugin version with `wp plugin get <plugin-slug> --field=version` or in the WordPress admin Plugins screen; versions through `2.2.0` are affected.\n- In the plugin's gateway settings, check whether the shared secret field is empty.\n- Review the plugin's payment-notification callback endpoint in web server logs for unexpected requests.","needs_analyst":true,"not_affected_if":["plugin-not-installed","newer-version","other-payment-gateway"],"who_is_affected":"Sites running the Payment Gateway WordPress plugin version 2.2.0 or earlier with WooCommerce are exposed, and the risk is greatest where the shared secret was never configured. The callback accepts unauthenticated requests, so the site does not need an account for an attacker to reach it. Sites on a fixed version, or using a different payment gateway, can skip this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.001071,"input_tokens":3345,"output_tokens":1472,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-103299':13A,16A '-2026':12A,15A '2.2.0':30B,89C 'allow':110C 'attack':6A,49B,112C 'authent':102C 'bank':45B,104C 'callback':109C,137C 'configur':97C,154C 'cve':11A,14A 'ensur':92C 'fail':75B,146C 'forg':51B,114C 'gateway':2A,26B,85C 'host':21B 'instal':126C 'let':5A,138C 'mark':7A,55B,119C 'move':70B,140C 'notif':47B,53B,108C,117C 'order':9A,58B,73B,122C,143C 'paid':10A,60B,124C 'payment':1A,18B,25B,46B,84C,107C 'payment-notif':106C 'pend':72B,142C 'plugin':4A,28B,87C 'requir':33B 'secret':36B,65B,80B,95C,129C,152C 'self':20B 'self-host':19B 'set':39B,82B,133C 'share':35B,94C 'site':62B 'state':147C 'unauthent':48B,111C 'unset':67B 'use':41B,99C 'valid':116C 'verifi':44B 'whether':76B,148C 'woocommerc':8A,22B,57B,121C 'wordpress':3A,23B,27B,86C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Payment Gateway WordPress plugin version 2.2.0 or earlier with WooCommerce are exposed, and the risk is greatest where the shared secret was never configured. The callback accepts unauthenticated requests, so the site does not need an account for an attacker to reach it. Sites on a fixed version, or using a different payment gateway, can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T07:17:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103299","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103299","severity":null,"published_at":"2026-10-26T07:17:06+00:00","modified_at":"2026-10-26T07:17:06+00:00","first_seen_at":"2026-10-26T07:28:49+00:00","fetched_at":"2026-10-26T07:28:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}