Live › vulnerability › CVE-2026-103327
The CryptoCloud WordPress plugin versions 3.0.0 through 3.0.1 accept payment notifications without checking they are authentic when the webhook secret is left empty. An unauthenticated attacker can mark any order as paid or failed without making a payment.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 09:19 UTC. All times on this page are UTC.
Sites running the CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 that take crypto payments through it. The exposure depends on the webhook secret being left at its empty default, so sites that set a secret are likely not affected. Stores on other payment plugins are not affected.
No product ranges from the sources yet.
wp plugin get cryptocloud3.0.1; the exact fixed version is unknownEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthenticated attackers to mark arbitrary orders as paid or failed without any payment being made.
This page as .md · .json · in your agent: get_signal("CVE-2026-103327")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.