{"id":"CVE-2026-103312","kind":"vulnerability","aliases":["CVE-2026-103312"],"related":[],"title":"Wompi WordPress plugin: forged payment callbacks mark orders paid","description":"The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment notifications on a stock install, because the callback's checksum is keyed on a merchant secret that is empty until it is manually configured, allowing an unauthenticated attacker to forge a notification and mark an arbitrary order as paid.","summary":"The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify incoming payment notifications when its checksum secret is unset, which is the default until a merchant configures it. An unauthenticated attacker can forge a notification and mark any order as paid.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","payments","wompi","wordpress"],"not_affected_if":["plugin-not-installed","secret-configured"],"how_to_check":"- Check the installed Wompi plugin version in the WordPress admin under Plugins; versions through `4.0.1` are affected.\n- Check whether the merchant secret used for the checksum is set in the plugin's settings; an empty value means the callback is unverified.","fix":"- Update the Wompi plugin to a release later than `4.0.1`; the sources do not name the fixed version.\n- Set the merchant checksum secret in the plugin settings until a fixed version is installed.","status":"open","published_at":"2026-10-27T06:17:23+00:00","first_seen_at":"2026-10-27T06:25:21+00:00","triaged_at":"2026-10-27T06:26:24+00:00","updated_at":"2026-10-27T06:26:24+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T06:26:24Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Wompi plugin to a release later than `4.0.1`; the sources do not name the fixed version.\n- Set the merchant checksum secret in the plugin settings until a fixed version is installed.","reach":"internet","title":"Wompi WordPress plugin: forged payment callbacks mark orders paid","impact":"medium","summary":"The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify incoming payment notifications when its checksum secret is unset, which is the default until a merchant configures it. An unauthenticated attacker can forge a notification and mark any order as paid.","category":"package","nicknames":[],"who_cares":["wordpress","wompi","ecommerce","payments"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker marks arbitrary orders paid without paying, causing revenue loss","analyst_note":"Confirm the fixed plugin version and whether the default empty secret is truly the stock state; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-103312.","how_to_check":"- Check the installed Wompi plugin version in the WordPress admin under Plugins; versions through `4.0.1` are affected.\n- Check whether the merchant secret used for the checksum is set in the plugin's settings; an empty value means the callback is unverified.","needs_analyst":true,"not_affected_if":["secret-configured","plugin-not-installed"],"who_is_affected":"WordPress sites running the Payment Integration Wompi plugin through 4.0.1 with the checksum secret left empty are exposed, because the callback accepts notifications it cannot verify. Sites that have configured the merchant secret, or that do not use this plugin, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00065,"input_tokens":3328,"output_tokens":635,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-103312':12A,15A '-2026':11A,14A '4.0.1':28B,70C 'allow':103C 'arbitrari':114C 'attack':52B,106C 'authent':75C 'callback':6A,86C 'checksum':37B,88C 'configur':48B,102C 'cve':10A,13A 'default':44B 'ecommerc':16B 'empti':97C 'forg':4A,54B,108C 'incom':32B,77C 'instal':83C 'integr':23B,65C 'key':90C 'manual':101C 'mark':7A,58B,112C 'merchant':47B,93C 'notif':34B,56B,79C,110C 'order':8A,60B,115C 'packag':17B 'paid':9A,62B,117C 'payment':5A,18B,22B,33B,64C,78C 'plugin':3A,26B,68C 'secret':38B,94C 'stock':82C 'unauthent':51B,105C 'unset':40B 'verifi':31B,73C 'wompi':1A,19B,24B,66C 'wordpress':2A,20B,25B,67C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the Payment Integration Wompi plugin through 4.0.1 with the checksum secret left empty are exposed, because the callback accepts notifications it cannot verify. Sites that have configured the merchant secret, or that do not use this plugin, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T06:17:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103312","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103312","severity":null,"published_at":"2026-10-27T06:17:23+00:00","modified_at":"2026-10-27T06:17:23+00:00","first_seen_at":"2026-10-27T06:25:21+00:00","fetched_at":"2026-10-27T06:25:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}