Live › vulnerability › CVE-2026-103325
Go to dashboardThe TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 checks its payment webhook signature against an empty key, so the check always passes. An unauthenticated attacker can send forged webhook notifications and mark any WooCommerce order as paid.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 07:30 UTC. All times on this page are UTC.
Stores running the TiendaCrypto para WooCommerce plugin through 1.2.1 that accept crypto payments through its webhook are exposed. The issue is worse on web servers that preserve request header case, per the description. Stores that do not use this plugin can skip it.
No product ranges from the sources yet.
1.2.1 are affected.1.2.1; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid on web servers that preserve request header case.
This page as .md · .json · in your agent: get_signal("CVE-2026-103325")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.