Live › vulnerability › CVE-2026-103300
Go to dashboardThe Eurobank WooCommerce Payment Gateway plugin through 2.1.1 does not verify that payment-confirmation requests come from the payment provider, and its authentication secret is empty by default. An unauthenticated attacker can mark any pending order as paid or force any order into a failed status.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 07:28 UTC. All times on this page are UTC.
Sites running the Eurobank WooCommerce Payment Gateway WordPress plugin version 2.1.1 or earlier, where the payment confirmation endpoint is reachable from the internet. Sites that do not use this plugin can skip it; the sources do not say whether a non-empty secret alone blocks the attack.
No product ranges from the sources yet.
2.1.1 or earlier.2.1.1; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending order as paid, and to force any order into a failed status without any secret at all.
This page as .md · .json · in your agent: get_signal("CVE-2026-103300")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.