Live › vulnerability › CVE-2026-103331
Go to dashboardThe UniPAY Payment Gateway plugin for WooCommerce through version 2.3 checks payment notification signatures against a merchant secret that is empty by default. An unauthenticated attacker can forge a valid-looking notification and mark any order as paid.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Stores running the UniPAY Payment Gateway For WooCommerce WordPress plugin through 2.3 that accept payment notifications from it. Exposure depends on the merchant secret being empty, which is the default; stores with a non-empty secret are not affected by the described forgery. The sources do not give a fixed version.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| unipay-payment-gateway-for-woocommerce | wordpress | <= 2.3 | 2.4 |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The UniPAY Payment Gateway For WooCommerce WordPress plugin through 2.3 does not properly verify the authenticity of payment notifications, as their signature is checked against a merchant secret that is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid.
This page as .md · .json · in your agent: get_signal("CVE-2026-103331")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.