Live › vulnerability › CVE-2026-103312
Go to dashboardThe Payment Integration Wompi WordPress plugin through 4.0.1 does not verify incoming payment notifications when its checksum secret is unset, which is the default until a merchant configures it. An unauthenticated attacker can forge a notification and mark any order as paid.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 06:25 UTC. All times on this page are UTC.
WordPress sites running the Payment Integration Wompi plugin through 4.0.1 with the checksum secret left empty are exposed, because the callback accepts notifications it cannot verify. Sites that have configured the merchant secret, or that do not use this plugin, can skip it.
No product ranges from the sources yet.
4.0.1 are affected.4.0.1; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment notifications on a stock install, because the callback's checksum is keyed on a merchant secret that is empty until it is manually configured, allowing an unauthenticated attacker to forge a notification and mark an arbitrary order as paid.
This page as .md · .json · in your agent: get_signal("CVE-2026-103312")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.