{"id":"CVE-2026-103327","kind":"vulnerability","aliases":["CVE-2026-103327"],"related":[],"title":"CryptoCloud WordPress plugin: forged payment callbacks mark orders paid","description":"The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthenticated attackers to mark arbitrary orders as paid or failed without any payment being made.","summary":"The CryptoCloud WordPress plugin versions 3.0.0 through 3.0.1 accept payment notifications without checking they are authentic when the webhook secret is left empty. An unauthenticated attacker can mark any order as paid or failed without making a payment.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cryptocloud","package","payments","woocommerce","wordpress"],"not_affected_if":["other-plugin-versions","webhook-secret-set"],"how_to_check":"- Check the installed CryptoCloud plugin version in the WordPress admin plugin list, or with `wp plugin get cryptocloud`\n- Check whether the webhook secret setting in the plugin is empty","fix":"- CryptoCloud WordPress plugin: move to a version later than `3.0.1`; the exact fixed version is unknown","status":"open","published_at":"2026-11-03T09:17:08+00:00","first_seen_at":"2026-11-03T09:19:50+00:00","triaged_at":"2026-11-03T09:20:29+00:00","updated_at":"2026-11-03T09:20:29+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T09:20:29Z","model":"claude-haiku-5-5","output":{"fix":"- CryptoCloud WordPress plugin: move to a version later than `3.0.1`; the exact fixed version is unknown","reach":"internet","title":"CryptoCloud WordPress plugin: forged payment callbacks mark orders paid","impact":"medium","summary":"The CryptoCloud WordPress plugin versions 3.0.0 through 3.0.1 accept payment notifications without checking they are authentic when the webhook secret is left empty. An unauthenticated attacker can mark any order as paid or failed without making a payment.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","cryptocloud","payments"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker marks orders paid without paying, losing goods or revenue","analyst_note":"Confirm the fixed plugin version and the exact default secret behaviour from the vendor or the WordPress.org plugin changelog; the NVD entry alone does not state a fix.","how_to_check":"- Check the installed CryptoCloud plugin version in the WordPress admin plugin list, or with `wp plugin get cryptocloud`\n- Check whether the webhook secret setting in the plugin is empty\n- unknown for anything beyond this","plain_action":"","needs_analyst":true,"not_affected_if":["webhook-secret-set","other-plugin-versions"],"who_is_affected":"Sites running the CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 that take crypto payments through it. The exposure depends on the webhook secret being left at its empty default, so sites that set a secret are likely not affected. Stores on other payment plugins are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000732,"input_tokens":4149,"output_tokens":634,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-103327':12A,15A '-2026':11A,14A '3.0.0':26B,64C '3.0.1':28B,66C 'accept':29B 'allow':97C 'arbitrari':102C 'attack':46B,99C 'authent':36B,71C 'callback':6A,80C 'check':33B,84C 'cryptocloud':1A,16B,22B,60C 'cve':10A,13A 'default':96C 'empti':43B,95C 'fail':54B,107C 'forg':4A 'gateway':79C 'integr':83C 'left':42B,92C 'made':112C 'make':56B 'mark':7A,48B,101C 'notif':31B,75C 'order':8A,50B,103C 'packag':17B 'paid':9A,52B,105C 'payment':5A,18B,30B,58B,74C,110C 'plugin':3A,24B,62C 'receiv':76C 'secret':40B,90C 'skip':86C 'unauthent':45B,98C 'verifi':69C 'version':25B 'webhook':39B,89C 'without':32B,55B,108C 'woocommerc':19B 'wordpress':2A,20B,23B,61C","nicknames":[],"mitigations":[],"who_affected":"Sites running the CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 that take crypto payments through it. The exposure depends on the webhook secret being left at its empty default, so sites that set a secret are likely not affected. Stores on other payment plugins are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cryptocloud","medium","package","payments","woocommerce","wordpress"],"first_public_at":"2026-11-03T09:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103327","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103327","severity":null,"published_at":"2026-11-03T09:17:08+00:00","modified_at":"2026-11-03T09:17:08+00:00","first_seen_at":"2026-11-03T09:19:50+00:00","fetched_at":"2026-11-03T09:19:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}