Live › vulnerability › CVE-2026-103319
Go to dashboardThe OPay Payment Gateway plugin for WooCommerce through 2.5.5 does not verify that payment notifications come from OPay, because the signature secret is empty by default. An unauthenticated attacker can forge a notification and mark any order as paid, cancelled or failed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 07:28 UTC. All times on this page are UTC.
Stores running the OPay Payment Gateway for WooCommerce plugin through 2.5.5 with the signature secret left empty, which is the default. Stores that use another payment gateway or have a non-empty secret set may not be exposed, though the sources do not confirm the secret setting's behaviour in every configuration.
No product ranges from the sources yet.
2.5.5 or earlier.2.5.5; the fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid, cancelled or failed.
This page as .md · .json · in your agent: get_signal("CVE-2026-103319")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.