Live › vulnerability › CVE-2026-103332
Go to dashboardThe Payex Payment Gateway plugin for WooCommerce through 1.2.10 does not verify incoming payment notifications properly, and its validation secret is empty by default. An unauthenticated attacker can forge a payment confirmation and mark any order as paid.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 06:25 UTC. All times on this page are UTC.
WooCommerce stores running the Payex Payment Gateway plugin version 1.2.10 or earlier (about 300 active installs). Exposure comes from the notification endpoint accepting forged payment confirmations when the validation secret is empty, which is the default. Stores not using Payex can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| payex-payment-gateway-for-woocommerce | wordpress | <= 1.2.10 | – |
1.2.10 or earlier.1.2.10 is the latest release and the plugin is closed on wordpress.org (temporary, since 2026-10-15)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Payex Payment Gateway for Woocommerce WordPress plugin through 1.2.10 does not properly verify the authenticity of incoming payment notifications, relying on a validation secret that is empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark any order as paid.
This page as .md · .json · in your agent: get_signal("CVE-2026-103332")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.