---
id: "CVE-2026-103331"
kind: "vulnerability"
aliases: ["CVE-2026-103331"]
title: "UniPAY WooCommerce plugin: forged payment notices mark unpaid orders as paid"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "unipay-payment-gateway-for-woocommerce", "fixed": ["2.4"], "affected": "<= 2.3", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["auth-bypass", "package", "self-hosted", "unipay", "woocommerce", "wordpress"]
not_affected_if: ["non-empty-merchant-secret", "plugin-not-installed", "version-2.4-or-later"]
published_at: "2026-10-28T06:16:31+00:00"
first_seen_at: "2026-10-28T06:31:26+00:00"
updated_at: "2026-10-28T06:33:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103331", "first_seen_at": "2026-10-28T06:31:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-28T06:33:25+00:00"}]
---

# UniPAY WooCommerce plugin: forged payment notices mark unpaid orders as paid

The UniPAY Payment Gateway plugin for WooCommerce through version 2.3 checks payment notification signatures against a merchant secret that is empty by default. An unauthenticated attacker can forge a valid-looking notification and mark any order as paid.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:unipay-payment-gateway-for-woocommerce affected <= 2.3 fixed 2.4

## How to check

- WordPress admin > Plugins: UniPAY Payment Gateway For WooCommerce version 2.3 or lower is affected; 2.4 is fixed.
- WooCommerce > Settings > Payments > UniPAY Checkout: an empty SecretKey on 2.3 or lower means forged notifications are accepted.
- Review orders marked paid without a matching UniPAY transaction.

## Fix

Update the UniPAY Payment Gateway For WooCommerce plugin to 2.4 (released 2026-10-22). Then confirm MerchantID and SecretKey are set in WooCommerce > Settings > Payments > UniPAY Checkout; 2.4 rejects notifications without a SecretKey.

## Timeline

- 2026-10-28T06:31:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103331
- 2026-10-28T06:33:25+00:00 analyst — Vendor changelog on wordpress.org: 2.4 (2026-10-22) rejects IPN unless SecretKey set and hash matches, gateway disabled until MerchantID/SecretKey set. WPScan lists CVSS 5.3 medium, PoC withheld until 2026-11-08, no exploitation seen. Did not search social.

## Documents

- [advisory] WPScan: UniPAY <= 2.3 Unauthenticated Order Payment Forgery via Empty IPN Secret https://wpscan.com/vulnerability/a7d61b5f-9e92-459c-8f6d-1c92ea94ef00/
- [fix] UniPAY Payment Gateway For WooCommerce - changelog 2.4 (wordpress.org) https://wordpress.org/plugins/unipay-payment-gateway-for-woocommerce/

## From the sources

The UniPAY Payment Gateway For WooCommerce WordPress plugin through 2.3 does not properly verify the authenticity of payment notifications, as their signature is checked against a merchant secret that is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_