Live › vulnerability › CVE-2026-103313
Go to dashboardThe BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not tie a payment provider's transaction confirmation to the specific order it completes, nor check the confirmed amount. An unauthenticated attacker holding one genuine low-value transaction can mark higher-value orders as paid.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Stores running the BitPay Gateway for WooCommerce plugin through 4.1.3 that accept BitPay payments are exposed. Stores that do not use this plugin, or that use a different payment gateway, can skip it.
No product ranges from the sources yet.
4.1.3 are affected.4.1.3; the sources do not name the fixed version, so check the plugin's changelog.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount, allowing an unauthenticated attacker who holds a single genuine low-value transaction to mark arbitrary higher-value orders as paid.
This page as .md · .json · in your agent: get_signal("CVE-2026-103313")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.