---
id: "CVE-2026-103312"
kind: "vulnerability"
aliases: ["CVE-2026-103312"]
title: "Wompi WordPress plugin: forged payment callbacks mark orders paid"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "package", "payments", "wompi", "wordpress"]
not_affected_if: ["plugin-not-installed", "secret-configured"]
published_at: "2026-10-27T06:17:23+00:00"
first_seen_at: "2026-10-27T06:25:21+00:00"
updated_at: "2026-10-27T06:26:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103312", "first_seen_at": "2026-10-27T06:25:21+00:00"}]
---

# Wompi WordPress plugin: forged payment callbacks mark orders paid

The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify incoming payment notifications when its checksum secret is unset, which is the default until a merchant configures it. An unauthenticated attacker can forge a notification and mark any order as paid.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Wompi plugin version in the WordPress admin under Plugins; versions through `4.0.1` are affected.
- Check whether the merchant secret used for the checksum is set in the plugin's settings; an empty value means the callback is unverified.

## Fix

- Update the Wompi plugin to a release later than `4.0.1`; the sources do not name the fixed version.
- Set the merchant checksum secret in the plugin settings until a fixed version is installed.

## Timeline

- 2026-10-27T06:25:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103312

## From the sources

The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment notifications on a stock install, because the callback's checksum is keyed on a merchant secret that is empty until it is manually configured, allowing an unauthenticated attacker to forge a notification and mark an arbitrary order as paid.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_