---
id: "CVE-2026-103319"
kind: "vulnerability"
aliases: ["CVE-2026-103319"]
title: "OPay WooCommerce plugin accepts forged payment notifications, marking orders paid"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "opay", "package", "woocommerce", "wordpress"]
not_affected_if: ["non-empty-secret", "other-payment-gateway"]
published_at: "2026-10-26T07:17:07+00:00"
first_seen_at: "2026-10-26T07:28:49+00:00"
updated_at: "2026-10-26T07:30:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103319", "first_seen_at": "2026-10-26T07:28:49+00:00"}]
---

# OPay WooCommerce plugin accepts forged payment notifications, marking orders paid

The OPay Payment Gateway plugin for WooCommerce through 2.5.5 does not verify that payment notifications come from OPay, because the signature secret is empty by default. An unauthenticated attacker can forge a notification and mark any order as paid, cancelled or failed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in WordPress admin under Plugins; affected if it is `2.5.5` or earlier.
- Check the plugin's OPay signature secret setting in WooCommerce payment settings; it is affected if the secret is empty.

## Fix

- Update the OPay Payment Gateway for WooCommerce plugin to a version later than `2.5.5`; the fixed version is unknown from the sources.
- Set a non-empty OPay signature secret until the plugin is updated, if the plugin setting allows it.

## Timeline

- 2026-10-26T07:28:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103319

## From the sources

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid, cancelled or failed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_