{"id":"CVE-2026-103331","kind":"vulnerability","aliases":["CVE-2026-103331"],"related":[],"title":"UniPAY WooCommerce plugin: forged payment notices mark unpaid orders as paid","description":"The UniPAY Payment Gateway For WooCommerce WordPress plugin through 2.3 does not properly verify the authenticity of payment notifications, as their signature is checked against a merchant secret that is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid.","summary":"The UniPAY Payment Gateway plugin for WooCommerce through version 2.3 checks payment notification signatures against a merchant secret that is empty by default. An unauthenticated attacker can forge a valid-looking notification and mark any order as paid.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"unipay-payment-gateway-for-woocommerce","fixed":["2.4"],"affected":"<= 2.3","ecosystem":"wordpress"}],"ecosystems":[],"tags":["auth-bypass","package","self-hosted","unipay","woocommerce","wordpress"],"not_affected_if":["non-empty-merchant-secret","plugin-not-installed","version-2.4-or-later"],"how_to_check":"- WordPress admin > Plugins: UniPAY Payment Gateway For WooCommerce version 2.3 or lower is affected; 2.4 is fixed.\n- WooCommerce > Settings > Payments > UniPAY Checkout: an empty SecretKey on 2.3 or lower means forged notifications are accepted.\n- Review orders marked paid without a matching UniPAY transaction.","fix":"Update the UniPAY Payment Gateway For WooCommerce plugin to 2.4 (released 2026-10-22). Then confirm MerchantID and SecretKey are set in WooCommerce > Settings > Payments > UniPAY Checkout; 2.4 rejects notifications without a SecretKey.","status":"open","published_at":"2026-10-28T06:16:31+00:00","first_seen_at":"2026-10-28T06:31:26+00:00","triaged_at":"2026-10-28T06:32:58+00:00","updated_at":"2026-10-28T06:33:25+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-28T06:32:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"UniPAY WooCommerce plugin: forged payment notices mark unpaid orders as paid","impact":"medium","summary":"The UniPAY Payment Gateway plugin for WooCommerce through version 2.3 checks payment notification signatures against a merchant secret that is empty by default. An unauthenticated attacker can forge a valid-looking notification and mark any order as paid.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","unipay","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker marks arbitrary store orders paid without paying","analyst_note":"Find the fixed plugin version and vendor advisory; the NVD entry gives no fix version or severity score.","how_to_check":"- Check the installed UniPAY Payment Gateway for WooCommerce plugin version; the sources say versions through `2.3` are affected.\n- Check whether the merchant secret used for notification signatures is set to a non-empty value in the plugin settings.","needs_analyst":true,"not_affected_if":["non-empty-merchant-secret","plugin-not-installed"],"who_is_affected":"Stores running the UniPAY Payment Gateway For WooCommerce WordPress plugin through 2.3 that accept payment notifications from it. Exposure depends on the merchant secret being empty, which is the default; stores with a non-empty secret are not affected by the described forgery. The sources do not give a fixed version.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00061,"input_tokens":3324,"output_tokens":555,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the fixed plugin version and vendor advisory; the NVD entry gives no fix version or severity score.","search":"'-103331':14A,17A '-2026':13A,16A '2.3':43B,82C 'allow':106C 'arbitrari':116C 'attack':59B,108C 'auth':25B 'auth-bypass':24B 'authent':88C 'bypass':26B 'check':44B,96C 'cve':12A,15A 'default':56B,105C 'empti':54B,103C 'for':22A 'forg':4A,61B,110C 'gateway':21A,37B,76C 'host':30B 'look':65B 'mark':7A,68B,115C 'merchant':50B,99C 'notic':6A 'notif':46B,66B,91C,113C 'order':9A,70B,117C 'packag':27B 'paid':11A,72B,119C 'payment':5A,20A,36B,45B,75C,90C 'plugin':3A,38B,80C 'proper':85C 'secret':51B,100C 'self':29B 'self-host':28B 'signatur':47B,94C 'unauthent':58B,107C 'unipay':1A,19A,31B,35B,74C 'unipay-payment-gateway-for-woocommerce':18A 'unpaid':8A 'valid':64B,112C 'valid-look':63B 'verifi':86C 'version':42B 'woocommerc':2A,32B,40B,78C 'woocommerce':23A 'wordpress':33B,79C","nicknames":[],"mitigations":[],"who_affected":"Stores running the UniPAY Payment Gateway For WooCommerce WordPress plugin through 2.3 that accept payment notifications from it. Exposure depends on the merchant secret being empty, which is the default; stores with a non-empty secret are not affected by the described forgery. The sources do not give a fixed version.","tier":"B","verified":{"fix":{"at":"2026-10-28T06:33:25Z","by":"analyst","run_id":941},"products":{"at":"2026-10-28T06:33:25Z","by":"analyst","run_id":941}},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103331","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103331","severity":null,"published_at":"2026-10-28T06:16:31+00:00","modified_at":"2026-10-28T06:16:31+00:00","first_seen_at":"2026-10-28T06:31:26+00:00","fetched_at":"2026-10-28T06:31:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-103331:941","url":null,"severity":null,"published_at":"2026-10-28T06:33:25+00:00","modified_at":"2026-10-28T06:33:25+00:00","first_seen_at":"2026-10-28T06:33:25+00:00","fetched_at":"2026-10-28T06:33:25+00:00","note":"Vendor changelog on wordpress.org: 2.4 (2026-10-22) rejects IPN unless SecretKey set and hash matches, gateway disabled until MerchantID/SecretKey set. WPScan lists CVSS 5.3 medium, PoC withheld until 2026-11-08, no exploitation seen. Did not search social."}],"documents":[{"id":9409,"url":"https://wordpress.org/plugins/unipay-payment-gateway-for-woocommerce/","title":"UniPAY Payment Gateway For WooCommerce - changelog 2.4 (wordpress.org)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":9410,"url":"https://wpscan.com/vulnerability/a7d61b5f-9e92-459c-8f6d-1c92ea94ef00/","title":"WPScan: UniPAY <= 2.3 Unauthenticated Order Payment Forgery via Empty IPN Secret","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}