---
id: "CVE-2026-103327"
kind: "vulnerability"
aliases: ["CVE-2026-103327"]
title: "CryptoCloud WordPress plugin: forged payment callbacks mark orders paid"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cryptocloud", "package", "payments", "woocommerce", "wordpress"]
not_affected_if: ["other-plugin-versions", "webhook-secret-set"]
published_at: "2026-11-03T09:17:08+00:00"
first_seen_at: "2026-11-03T09:19:50+00:00"
updated_at: "2026-11-03T09:20:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103327", "first_seen_at": "2026-11-03T09:19:50+00:00"}]
---

# CryptoCloud WordPress plugin: forged payment callbacks mark orders paid

The CryptoCloud WordPress plugin versions 3.0.0 through 3.0.1 accept payment notifications without checking they are authentic when the webhook secret is left empty. An unauthenticated attacker can mark any order as paid or failed without making a payment.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed CryptoCloud plugin version in the WordPress admin plugin list, or with `wp plugin get cryptocloud`
- Check whether the webhook secret setting in the plugin is empty

## Fix

- CryptoCloud WordPress plugin: move to a version later than `3.0.1`; the exact fixed version is unknown

## Timeline

- 2026-11-03T09:19:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103327

## From the sources

The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthenticated attackers to mark arbitrary orders as paid or failed without any payment being made.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_