Live › vulnerability › CVE-2026-103359
Go to dashboardThe PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify incoming payment notifications, and before the gateway is configured it checks them against a value computed from an empty secret. An unauthenticated attacker can send a forged notification and mark arbitrary WooCommerce orders as paid and completed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 07:30 UTC. All times on this page are UTC.
Sites running the PayDunya WooCommerce Payment Gateway plugin version 1.1.6 or earlier are exposed, and the unconfigured state is the most dangerous one. Stores that have set up the gateway with their keys are less exposed, though the sources say verification is missing in general. Stores that do not use this plugin can skip it.
No product ranges from the sources yet.
wp plugin get paydunya-woocommerce --field=version if the slug matches.1.1.6 once a fixed release is available; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming payment notifications and, until the gateway is configured, authenticates them with a value derived from an empty secret that anyone can compute, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid and completed.
This page as .md · .json · in your agent: get_signal("CVE-2026-103359")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.