{"id":"CVE-2026-103332","kind":"vulnerability","aliases":["CVE-2026-103332"],"related":[],"title":"Payex WooCommerce plugin: forged payment notices mark orders paid","description":"The Payex Payment Gateway for Woocommerce WordPress plugin through 1.2.10 does not properly verify the authenticity of incoming payment notifications, relying on a validation secret that is empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark any order as paid.","summary":"The Payex Payment Gateway plugin for WooCommerce through 1.2.10 does not verify incoming payment notifications properly, and its validation secret is empty by default. An unauthenticated attacker can forge a payment confirmation and mark any order as paid.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"payex-payment-gateway-for-woocommerce","fixed":[],"affected":"<= 1.2.10","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","payex","self-hosted","woocommerce","wordpress"],"not_affected_if":["non-default-config","not-using-payex"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; affected if it is `1.2.10` or earlier.\n- Check whether the payment validation secret setting is empty in the Payex gateway settings in WooCommerce.","fix":"No fixed version known: 1.2.10 is the latest release and the plugin is closed on wordpress.org (temporary, since 2026-10-15). Deactivate or replace the plugin until the vendor ships a fix. Setting the Payex secret in gateway settings is a likely partial mitigation but is unconfirmed.","status":"open","published_at":"2026-10-27T06:17:23+00:00","first_seen_at":"2026-10-27T06:25:21+00:00","triaged_at":"2026-10-27T06:26:24+00:00","updated_at":"2026-10-27T06:27:57+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-27T06:26:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Payex WooCommerce plugin: forged payment notices mark orders paid","impact":"medium","summary":"The Payex Payment Gateway plugin for WooCommerce through 1.2.10 does not verify incoming payment notifications properly, and its validation secret is empty by default. An unauthenticated attacker can forge a payment confirmation and mark any order as paid.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","payex","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker marks unpaid orders as paid without paying.","analyst_note":"Confirm the fixed plugin version and whether setting a secret fully mitigates it; check the NVD entry and the plugin's changelog.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; affected if it is `1.2.10` or earlier.\n- Check whether the payment validation secret setting is empty in the Payex gateway settings in WooCommerce.","needs_analyst":true,"not_affected_if":["not-using-payex","non-default-config"],"who_is_affected":"Stores running the Payex Payment Gateway for WooCommerce plugin version 1.2.10 or earlier, where the validation secret was left empty. Stores that do not use Payex, or that have set a non-empty validation secret, are likely not exposed, though the sources do not confirm this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.0006,"input_tokens":3319,"output_tokens":537,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed plugin version and whether setting a secret fully mitigates it; check the NVD entry and the plugin's changelog.","search":"'-103332':12A,15A '-2026':11A,14A '1.2.10':37B,76C 'allow':97C 'attack':55B,99C 'authent':82C 'confirm':60B,105C 'cve':10A,13A 'default':52B,96C 'empti':50B,94C 'for':20A 'forg':4A,57B,101C 'gateway':19A,32B,70C 'host':26B 'incom':41B,84C 'mark':7A,62B,107C 'notic':6A 'notif':43B,86C 'order':8A,64B,109C 'packag':22B 'paid':9A,66B,111C 'payex':1A,17A,23B,30B,68C 'payex-payment-gateway-for-woocommerce':16A 'payment':5A,18A,31B,42B,59B,69C,85C,104C 'plugin':3A,33B,74C 'proper':44B,79C 'reli':87C 'secret':48B,91C 'self':25B 'self-host':24B 'unauthent':54B,98C 'valid':47B,90C,103C 'verifi':40B,80C 'woocommerc':2A,27B,35B,72C 'woocommerce':21A 'wordpress':28B,73C","nicknames":[],"mitigations":[],"who_affected":"WooCommerce stores running the Payex Payment Gateway plugin version 1.2.10 or earlier (about 300 active installs). Exposure comes from the notification endpoint accepting forged payment confirmations when the validation secret is empty, which is the default. Stores not using Payex can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T06:17:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103332","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103332","severity":null,"published_at":"2026-10-27T06:17:23+00:00","modified_at":"2026-10-27T06:17:23+00:00","first_seen_at":"2026-10-27T06:25:21+00:00","fetched_at":"2026-10-27T06:25:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-103332:855","url":null,"severity":null,"published_at":"2026-10-27T06:27:57+00:00","modified_at":"2026-10-27T06:27:57+00:00","first_seen_at":"2026-10-27T06:27:57+00:00","fetched_at":"2026-10-27T06:27:57+00:00","note":"No vendor advisory or patched version found; NVD page returned empty via web-cli. WP Beacon shows 1.2.10 (2025-02-10) is latest and plugin closed on wp.org 2026-10-15 (temporary, pending review). Whether setting the secret fully mitigates is unconfirmed; nothing verified."}],"documents":[{"id":5380,"url":"https://wpbeacon.io/plugins/payex-payment-gateway-for-woocommerce/","title":"WP Beacon: Payex Payment Gateway for WooCommerce (closed on wp.org 2026-10-15, latest 1.2.10)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}