{"id":"CVE-2026-103300","kind":"vulnerability","aliases":["CVE-2026-103300"],"related":[],"title":"WooCommerce Eurobank gateway plugin lets attackers mark orders paid","description":"The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending order as paid, and to force any order into a failed status without any secret at all.","summary":"The Eurobank WooCommerce Payment Gateway plugin through 2.1.1 does not verify that payment-confirmation requests come from the payment provider, and its authentication secret is empty by default. An unauthenticated attacker can mark any pending order as paid or force any order into a failed status.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","payments","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Eurobank WooCommerce Payment Gateway plugin in the WordPress admin plugin list, and flag `2.1.1` or earlier.\n- Check whether the plugin's shared secret setting is empty.\n- unknown","fix":"- Update the Eurobank WooCommerce Payment Gateway plugin to a version later than `2.1.1`; the sources do not name a fixed version.\n- Set a non-empty shared secret in the plugin settings until a fixed version is installed.","status":"open","published_at":"2026-10-26T07:17:06+00:00","first_seen_at":"2026-10-26T07:28:49+00:00","triaged_at":"2026-10-26T07:29:58+00:00","updated_at":"2026-10-26T07:29:58+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T07:29:58Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Eurobank WooCommerce Payment Gateway plugin to a version later than `2.1.1`; the sources do not name a fixed version.\n- Set a non-empty shared secret in the plugin settings until a fixed version is installed.","reach":"internet","title":"WooCommerce Eurobank gateway plugin lets attackers mark orders paid","impact":"medium","summary":"The Eurobank WooCommerce Payment Gateway plugin through 2.1.1 does not verify that payment-confirmation requests come from the payment provider, and its authentication secret is empty by default. An unauthenticated attacker can mark any pending order as paid or force any order into a failed status.","category":"package","nicknames":[],"who_cares":["woocommerce","wordpress","ecommerce","payments"],"confidence":0.6,"needs_auth":"no","worst_case":"Attackers mark unpaid orders as paid or fail legitimate orders","analyst_note":"Confirm the fixed plugin version and whether a non-empty secret blocks the attack, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-103300.","how_to_check":"- Check the installed version of the Eurobank WooCommerce Payment Gateway plugin in the WordPress admin plugin list, and flag `2.1.1` or earlier.\n- Check whether the plugin's shared secret setting is empty.\n- unknown","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Eurobank WooCommerce Payment Gateway WordPress plugin version 2.1.1 or earlier, where the payment confirmation endpoint is reachable from the internet. Sites that do not use this plugin can skip it; the sources do not say whether a non-empty secret alone blocks the attack.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00067,"input_tokens":3348,"output_tokens":670,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-103300':12A,15A '-2026':11A,14A '2.1.1':28B,76C 'allow':104C 'attack':6A,52B,106C 'authent':44B,99C 'come':37B 'confirm':35B,84C 'cve':10A,13A 'default':49B,103C 'ecommerc':16B 'empti':47B,101C 'eurobank':2A,22B,69C 'fail':66B,121C 'forc':61B,116C 'gateway':3A,25B,72C 'genuin':86C 'let':5A 'mark':7A,54B,108C 'order':8A,57B,63B,111C,118C 'origin':87C 'packag':17B 'paid':9A,59B,113C 'payment':18B,24B,34B,40B,71C,83C,90C 'payment-confirm':33B,82C 'pend':56B,110C 'plugin':4A,26B,74C 'provid':41B,91C 'request':36B,85C 'secret':45B,96C,125C 'ship':93C 'status':67B,122C 'unauthent':51B,105C 'verifi':31B,79C 'without':123C 'woocommerc':1A,19B,23B,70C 'wordpress':20B,73C 'would':98C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Eurobank WooCommerce Payment Gateway WordPress plugin version 2.1.1 or earlier, where the payment confirmation endpoint is reachable from the internet. Sites that do not use this plugin can skip it; the sources do not say whether a non-empty secret alone blocks the attack.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T07:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103300","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103300","severity":null,"published_at":"2026-10-26T07:17:06+00:00","modified_at":"2026-10-26T07:17:06+00:00","first_seen_at":"2026-10-26T07:28:49+00:00","fetched_at":"2026-10-26T07:28:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}