{"id":"CVE-2026-103325","kind":"vulnerability","aliases":["CVE-2026-103325"],"related":[],"title":"TiendaCrypto WooCommerce plugin: forged payment webhooks mark orders as paid","description":"The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid on web servers that preserve request header case.","summary":"The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 checks its payment webhook signature against an empty key, so the check always passes. An unauthenticated attacker can send forged webhook notifications and mark any WooCommerce order as paid.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","woocommerce","wordpress"],"not_affected_if":["plugin-newer-than-1.2.1","plugin-not-installed"],"how_to_check":"- Check the installed version of the TiendaCrypto para WooCommerce plugin in the WordPress admin under Plugins; versions through `1.2.1` are affected.\n- Look for unpaid or pending WooCommerce orders marked as paid without a matching payment record at the crypto provider.","fix":"- Update the TiendaCrypto para WooCommerce plugin to a version later than `1.2.1`; the sources do not name a fixed version.\n- If no fixed version exists, disable the plugin until the webhook signature is verified against a real key.","status":"open","published_at":"2026-10-27T07:16:31+00:00","first_seen_at":"2026-10-27T07:30:43+00:00","triaged_at":"2026-10-27T07:32:01+00:00","updated_at":"2026-10-27T07:32:01+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T07:32:01Z","model":"claude-haiku-5-5","output":{"fix":"- Update the TiendaCrypto para WooCommerce plugin to a version later than `1.2.1`; the sources do not name a fixed version.\n- If no fixed version exists, disable the plugin until the webhook signature is verified against a real key.","reach":"internet","title":"TiendaCrypto WooCommerce plugin: forged payment webhooks mark orders as paid","impact":"medium","summary":"The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 checks its payment webhook signature against an empty key, so the check always passes. An unauthenticated attacker can send forged webhook notifications and mark any WooCommerce order as paid.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","ecommerce"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker marks arbitrary WooCommerce orders as paid without paying.","analyst_note":"Confirm the fixed plugin version and whether a patch exists; the NVD entry gives no fix version.","how_to_check":"- Check the installed version of the TiendaCrypto para WooCommerce plugin in the WordPress admin under Plugins; versions through `1.2.1` are affected.\n- Look for unpaid or pending WooCommerce orders marked as paid without a matching payment record at the crypto provider.","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-newer-than-1.2.1"],"who_is_affected":"Stores running the TiendaCrypto para WooCommerce plugin through 1.2.1 that accept crypto payments through its webhook are exposed. The issue is worse on web servers that preserve request header case, per the description. Stores that do not use this plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000656,"input_tokens":3343,"output_tokens":643,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-103325':13A,16A '-2026':12A,15A '1.2.1':28B,65C 'allow':88C 'alway':41B,85C 'arbitrari':97C 'attack':45B,90C 'authent':71C 'case':109C 'check':29B,40B 'correct':68C 'cve':11A,14A 'ecommerc':17B 'empti':36B,86C 'forg':4A,48B,92C 'header':108C 'key':37B,82C 'mark':7A,52B,96C 'notif':50B,94C 'order':8A,55B,99C 'packag':18B 'paid':10A,57B,101C 'para':23B,60C 'pass':42B 'payment':5A,31B,74C 'plugin':3A,26B,63C 'preserv':106C 'request':78C,107C 'send':47B 'server':104C 'signatur':33B,79C 'tiendacrypto':1A,22B,59C 'unauthent':44B,89C 'valid':76C 'verifi':69C 'web':103C 'webhook':6A,32B,49B,75C,93C 'woocommerc':2A,19B,24B,54B,61C,98C 'wordpress':20B,25B,62C","nicknames":[],"mitigations":[],"who_affected":"Stores running the TiendaCrypto para WooCommerce plugin through 1.2.1 that accept crypto payments through its webhook are exposed. The issue is worse on web servers that preserve request header case, per the description. Stores that do not use this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T07:16:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103325","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103325","severity":null,"published_at":"2026-10-27T07:16:31+00:00","modified_at":"2026-10-27T07:16:31+00:00","first_seen_at":"2026-10-27T07:30:43+00:00","fetched_at":"2026-10-27T07:30:43+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}