---
id: "CVE-2026-103299"
kind: "vulnerability"
aliases: ["CVE-2026-103299"]
title: "Payment Gateway WordPress plugin lets attackers mark WooCommerce orders paid"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "payments", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["newer-version", "other-payment-gateway", "plugin-not-installed"]
published_at: "2026-10-26T07:17:06+00:00"
first_seen_at: "2026-10-26T07:28:49+00:00"
updated_at: "2026-10-26T07:30:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103299", "first_seen_at": "2026-10-26T07:28:49+00:00"}]
---

# Payment Gateway WordPress plugin lets attackers mark WooCommerce orders paid

The Payment Gateway WordPress plugin through 2.2.0 does not require its shared secret to be set before using it to verify bank payment notifications. Unauthenticated attackers can forge a notification to mark any WooCommerce order as paid on sites where the secret is unset, and can move any pending order to failed whether or not the secret is set.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed plugin version with `wp plugin get <plugin-slug> --field=version` or in the WordPress admin Plugins screen; versions through `2.2.0` are affected.
- In the plugin's gateway settings, check whether the shared secret field is empty.
- Review the plugin's payment-notification callback endpoint in web server logs for unexpected requests.

## Fix

- Update the Payment Gateway plugin to a version later than `2.2.0`; the fixed version is unknown from the sources.
- Set a strong shared secret in the plugin's gateway settings until the update is applied.
- Audit recently changed WooCommerce orders for payments that did not reach the bank.

## Timeline

- 2026-10-26T07:28:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103299

## From the sources

The Payment Gateway  WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the secret has not been set, and the same callback lets them move any pending order to a failed state whether or not the secret is configured.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_