---
id: "CVE-2026-103300"
kind: "vulnerability"
aliases: ["CVE-2026-103300"]
title: "WooCommerce Eurobank gateway plugin lets attackers mark orders paid"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "package", "payments", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-26T07:17:06+00:00"
first_seen_at: "2026-10-26T07:28:49+00:00"
updated_at: "2026-10-26T07:29:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103300", "first_seen_at": "2026-10-26T07:28:49+00:00"}]
---

# WooCommerce Eurobank gateway plugin lets attackers mark orders paid

The Eurobank WooCommerce Payment Gateway plugin through 2.1.1 does not verify that payment-confirmation requests come from the payment provider, and its authentication secret is empty by default. An unauthenticated attacker can mark any pending order as paid or force any order into a failed status.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Eurobank WooCommerce Payment Gateway plugin in the WordPress admin plugin list, and flag `2.1.1` or earlier.
- Check whether the plugin's shared secret setting is empty.
- unknown

## Fix

- Update the Eurobank WooCommerce Payment Gateway plugin to a version later than `2.1.1`; the sources do not name a fixed version.
- Set a non-empty shared secret in the plugin settings until a fixed version is installed.

## Timeline

- 2026-10-26T07:28:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103300

## From the sources

The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending order as paid, and to force any order into a failed status without any secret at all.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_