---
id: "CVE-2026-103332"
kind: "vulnerability"
aliases: ["CVE-2026-103332"]
title: "Payex WooCommerce plugin: forged payment notices mark orders paid"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "payex-payment-gateway-for-woocommerce", "fixed": [], "affected": "<= 1.2.10", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "payex", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["non-default-config", "not-using-payex"]
published_at: "2026-10-27T06:17:23+00:00"
first_seen_at: "2026-10-27T06:25:21+00:00"
updated_at: "2026-10-27T06:27:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103332", "first_seen_at": "2026-10-27T06:25:21+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T06:27:57+00:00"}]
---

# Payex WooCommerce plugin: forged payment notices mark orders paid

The Payex Payment Gateway plugin for WooCommerce through 1.2.10 does not verify incoming payment notifications properly, and its validation secret is empty by default. An unauthenticated attacker can forge a payment confirmation and mark any order as paid.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:payex-payment-gateway-for-woocommerce affected <= 1.2.10 fixed ?

## How to check

- Check the installed plugin version in the WordPress admin under Plugins; affected if it is `1.2.10` or earlier.
- Check whether the payment validation secret setting is empty in the Payex gateway settings in WooCommerce.

## Fix

No fixed version known: 1.2.10 is the latest release and the plugin is closed on wordpress.org (temporary, since 2026-10-15). Deactivate or replace the plugin until the vendor ships a fix. Setting the Payex secret in gateway settings is a likely partial mitigation but is unconfirmed.

## Timeline

- 2026-10-27T06:25:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103332
- 2026-10-27T06:27:57+00:00 analyst — No vendor advisory or patched version found; NVD page returned empty via web-cli. WP Beacon shows 1.2.10 (2025-02-10) is latest and plugin closed on wp.org 2026-10-15 (temporary, pending review). Whether setting the secret fully mitigates is unconfirmed; nothing verified.

## Documents

- [mentions] WP Beacon: Payex Payment Gateway for WooCommerce (closed on wp.org 2026-10-15, latest 1.2.10) https://wpbeacon.io/plugins/payex-payment-gateway-for-woocommerce/

## From the sources

The Payex Payment Gateway for Woocommerce WordPress plugin through 1.2.10 does not properly verify the authenticity of incoming payment notifications, relying on a validation secret that is empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark any order as paid.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_