{"id":"CVE-2026-103319","kind":"vulnerability","aliases":["CVE-2026-103319"],"related":[],"title":"OPay WooCommerce plugin accepts forged payment notifications, marking orders paid","description":"The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid, cancelled or failed.","summary":"The OPay Payment Gateway plugin for WooCommerce through 2.5.5 does not verify that payment notifications come from OPay, because the signature secret is empty by default. An unauthenticated attacker can forge a notification and mark any order as paid, cancelled or failed.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","opay","package","woocommerce","wordpress"],"not_affected_if":["non-empty-secret","other-payment-gateway"],"how_to_check":"- Check the installed plugin version in WordPress admin under Plugins; affected if it is `2.5.5` or earlier.\n- Check the plugin's OPay signature secret setting in WooCommerce payment settings; it is affected if the secret is empty.","fix":"- Update the OPay Payment Gateway for WooCommerce plugin to a version later than `2.5.5`; the fixed version is unknown from the sources.\n- Set a non-empty OPay signature secret until the plugin is updated, if the plugin setting allows it.","status":"open","published_at":"2026-10-26T07:17:07+00:00","first_seen_at":"2026-10-26T07:28:49+00:00","triaged_at":"2026-10-26T07:30:03+00:00","updated_at":"2026-10-26T07:30:03+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T07:30:03Z","model":"claude-haiku-5-5","output":{"fix":"- Update the OPay Payment Gateway for WooCommerce plugin to a version later than `2.5.5`; the fixed version is unknown from the sources.\n- Set a non-empty OPay signature secret until the plugin is updated, if the plugin setting allows it.","reach":"internet","title":"OPay WooCommerce plugin accepts forged payment notifications, marking orders paid","impact":"medium","summary":"The OPay Payment Gateway plugin for WooCommerce through 2.5.5 does not verify that payment notifications come from OPay, because the signature secret is empty by default. An unauthenticated attacker can forge a notification and mark any order as paid, cancelled or failed.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","ecommerce","opay"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker marks arbitrary store orders as paid without paying.","analyst_note":"Confirm the fixed plugin version and whether a non-empty secret fully blocks forged notifications, using the NVD entry and the plugin vendor's changelog.","how_to_check":"- Check the installed plugin version in WordPress admin under Plugins; affected if it is `2.5.5` or earlier.\n- Check the plugin's OPay signature secret setting in WooCommerce payment settings; it is affected if the secret is empty.","needs_analyst":true,"not_affected_if":["other-payment-gateway","non-empty-secret"],"who_is_affected":"Stores running the OPay Payment Gateway for WooCommerce plugin through 2.5.5 with the signature secret left empty, which is the default. Stores that use another payment gateway or have a non-empty secret set may not be exposed, though the sources do not confirm the secret setting's behaviour in every configuration.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000662,"input_tokens":3328,"output_tokens":658,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-103319':13A,16A '-2026':12A,15A '2.5.5':30B,73C 'accept':4A 'allow':98C 'arbitrari':108C 'attack':50B,100C 'cancel':61B,112C 'come':37B 'cve':11A,14A 'default':47B,97C 'ecommerc':17B 'empti':45B,95C 'fail':63B,114C 'forg':5A,52B,102C 'gateway':25B,67C 'mark':8A,56B,107C 'notif':7A,36B,54B,80C,105C 'opay':1A,18B,23B,39B,65C 'order':9A,58B,109C 'origin':81C 'packag':19B 'paid':10A,60B,111C 'payment':6A,24B,35B,66C,79C,84C 'plugin':3A,26B,71C 'proper':76C 'provid':85C 'secret':43B,88C 'signatur':42B,93C 'unauthent':49B,99C 'use':89C 'valid':91C,104C 'verifi':33B,77C 'woocommerc':2A,20B,28B,69C 'wordpress':21B,70C","nicknames":[],"mitigations":[],"who_affected":"Stores running the OPay Payment Gateway for WooCommerce plugin through 2.5.5 with the signature secret left empty, which is the default. Stores that use another payment gateway or have a non-empty secret set may not be exposed, though the sources do not confirm the secret setting's behaviour in every configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T07:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103319","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103319","severity":null,"published_at":"2026-10-26T07:17:07+00:00","modified_at":"2026-10-26T07:17:07+00:00","first_seen_at":"2026-10-26T07:28:49+00:00","fetched_at":"2026-10-26T07:28:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}