{"id":"CVE-2026-103313","kind":"vulnerability","aliases":["CVE-2026-103313"],"related":[],"title":"BitPay Gateway for WooCommerce: unpaid orders can be marked paid","description":"The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount, allowing an unauthenticated attacker who holds a single genuine low-value transaction to mark arbitrary higher-value orders as paid.","summary":"The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not tie a payment provider's transaction confirmation to the specific order it completes, nor check the confirmed amount. An unauthenticated attacker holding one genuine low-value transaction can mark higher-value orders as paid.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bitpay","ecommerce","package","woocommerce","wordpress"],"not_affected_if":["different-payment-gateway","plugin-not-installed"],"how_to_check":"- Check the installed version of the BitPay Gateway for WooCommerce plugin in the WordPress admin under Plugins; versions through `4.1.3` are affected.\n- Review recent WooCommerce orders marked paid with low or mismatched BitPay transaction amounts.","fix":"- Update the BitPay Gateway for WooCommerce plugin to a version later than `4.1.3`; the sources do not name the fixed version, so check the plugin's changelog.\n- If no fixed version is available, disable the BitPay gateway in WooCommerce payment settings.","status":"open","published_at":"2026-10-28T11:17:13+00:00","first_seen_at":"2026-10-28T11:32:27+00:00","triaged_at":"2026-10-28T11:33:40+00:00","updated_at":"2026-10-28T11:33:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T11:33:40Z","model":"claude-haiku-5-5","output":{"fix":"- Update the BitPay Gateway for WooCommerce plugin to a version later than `4.1.3`; the sources do not name the fixed version, so check the plugin's changelog.\n- If no fixed version is available, disable the BitPay gateway in WooCommerce payment settings.","reach":"internet","title":"BitPay Gateway for WooCommerce: unpaid orders can be marked paid","impact":"medium","summary":"The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not tie a payment provider's transaction confirmation to the specific order it completes, nor check the confirmed amount. An unauthenticated attacker holding one genuine low-value transaction can mark higher-value orders as paid.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","bitpay","ecommerce"],"confidence":0.6,"needs_auth":"no","worst_case":"Attackers mark unpaid high-value orders as paid, causing financial loss.","analyst_note":"","how_to_check":"- Check the installed version of the BitPay Gateway for WooCommerce plugin in the WordPress admin under Plugins; versions through `4.1.3` are affected.\n- Review recent WooCommerce orders marked paid with low or mismatched BitPay transaction amounts.","needs_analyst":false,"not_affected_if":["plugin-not-installed","different-payment-gateway"],"who_is_affected":"Stores running the BitPay Gateway for WooCommerce plugin through 4.1.3 that accept BitPay payments are exposed. Stores that do not use this plugin, or that use a different payment gateway, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00064,"input_tokens":3337,"output_tokens":612,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-103313':13A,16A '-2026':12A,15A '4.1.3':30B,77C 'allow':97C 'amount':50B,96C 'arbitrari':112C 'attack':53B,100C 'bind':80C 'bitpay':1A,17B,23B,70C 'check':47B 'complet':45B,91C 'confirm':39B,49B,86C,95C 'cve':11A,14A 'ecommerc':18B 'gateway':2A,24B,71C 'genuin':56B,105C 'higher':64B,114C 'higher-valu':63B,113C 'hold':54B,102C 'low':58B,107C 'low-valu':57B,106C 'mark':9A,62B,111C 'one':55B 'order':6A,43B,66B,89C,116C 'packag':19B 'paid':10A,68B,118C 'payment':35B,82C 'plugin':28B,75C 'provid':36B,83C 'singl':104C 'specif':42B 'tie':33B 'transact':38B,60B,85C,109C 'unauthent':52B,99C 'unpaid':5A 'valu':59B,65B,108C,115C 'verifi':93C 'woocommerc':4A,20B,26B,73C 'wordpress':21B,27B,74C","nicknames":[],"mitigations":[],"who_affected":"Stores running the BitPay Gateway for WooCommerce plugin through 4.1.3 that accept BitPay payments are exposed. Stores that do not use this plugin, or that use a different payment gateway, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103313","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103313","severity":null,"published_at":"2026-10-28T11:17:13+00:00","modified_at":"2026-10-28T11:17:13+00:00","first_seen_at":"2026-10-28T11:32:27+00:00","fetched_at":"2026-10-28T11:32:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}