---
id: "CVE-2026-103313"
kind: "vulnerability"
aliases: ["CVE-2026-103313"]
title: "BitPay Gateway for WooCommerce: unpaid orders can be marked paid"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bitpay", "ecommerce", "package", "woocommerce", "wordpress"]
not_affected_if: ["different-payment-gateway", "plugin-not-installed"]
published_at: "2026-10-28T11:17:13+00:00"
first_seen_at: "2026-10-28T11:32:27+00:00"
updated_at: "2026-10-28T11:33:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103313", "first_seen_at": "2026-10-28T11:32:27+00:00"}]
---

# BitPay Gateway for WooCommerce: unpaid orders can be marked paid

The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not tie a payment provider's transaction confirmation to the specific order it completes, nor check the confirmed amount. An unauthenticated attacker holding one genuine low-value transaction can mark higher-value orders as paid.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the BitPay Gateway for WooCommerce plugin in the WordPress admin under Plugins; versions through `4.1.3` are affected.
- Review recent WooCommerce orders marked paid with low or mismatched BitPay transaction amounts.

## Fix

- Update the BitPay Gateway for WooCommerce plugin to a version later than `4.1.3`; the sources do not name the fixed version, so check the plugin's changelog.
- If no fixed version is available, disable the BitPay gateway in WooCommerce payment settings.

## Timeline

- 2026-10-28T11:32:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103313

## From the sources

The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount, allowing an unauthenticated attacker who holds a single genuine low-value transaction to mark arbitrary higher-value orders as paid.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_