{"id":"CVE-2026-103359","kind":"vulnerability","aliases":["CVE-2026-103359"],"related":[],"title":"PayDunya WooCommerce plugin: forged payment notices mark orders paid","description":"The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming payment notifications and, until the gateway is configured, authenticates them with a value derived from an empty secret that anyone can compute, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid and completed.","summary":"The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify incoming payment notifications, and before the gateway is configured it checks them against a value computed from an empty secret. An unauthenticated attacker can send a forged notification and mark arbitrary WooCommerce orders as paid and completed.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","paydunya","self-hosted","woocommerce","wordpress"],"not_affected_if":["other-payment-gateway","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in WordPress admin under Plugins, or with `wp plugin get paydunya-woocommerce --field=version` if the slug matches.\n- Check whether the PayDunya gateway has been configured with its live keys in WooCommerce > Settings > Payments.\n- Review recent WooCommerce orders marked completed with no matching PayDunya payment record.","fix":"- Update the PayDunya WooCommerce Payment Gateway plugin to a version later than `1.1.6` once a fixed release is available; the sources do not name the fixed version.\n- Configure the PayDunya gateway with its keys until a fixed release is installed, since the empty-secret check only applies before configuration.\n- Audit orders marked paid and completed that have no matching PayDunya transaction.","status":"open","published_at":"2026-10-27T07:16:31+00:00","first_seen_at":"2026-10-27T07:30:43+00:00","triaged_at":"2026-10-27T07:32:02+00:00","updated_at":"2026-10-27T07:32:02+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T07:32:02Z","model":"claude-haiku-5-5","output":{"fix":"- Update the PayDunya WooCommerce Payment Gateway plugin to a version later than `1.1.6` once a fixed release is available; the sources do not name the fixed version.\n- Configure the PayDunya gateway with its keys until a fixed release is installed, since the empty-secret check only applies before configuration.\n- Audit orders marked paid and completed that have no matching PayDunya transaction.","reach":"internet","title":"PayDunya WooCommerce plugin: forged payment notices mark orders paid","impact":"medium","summary":"The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify incoming payment notifications, and before the gateway is configured it checks them against a value computed from an empty secret. An unauthenticated attacker can send a forged notification and mark arbitrary WooCommerce orders as paid and completed.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","paydunya","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker marks arbitrary store orders paid and completed without paying.","analyst_note":"Find the fixed plugin version and confirm whether the empty-secret behaviour applies only before configuration, from the NVD entry and the plugin's changelog.","how_to_check":"- Check the installed plugin version in WordPress admin under Plugins, or with `wp plugin get paydunya-woocommerce --field=version` if the slug matches.\n- Check whether the PayDunya gateway has been configured with its live keys in WooCommerce > Settings > Payments.\n- Review recent WooCommerce orders marked completed with no matching PayDunya payment record.","needs_analyst":true,"not_affected_if":["plugin-not-installed","other-payment-gateway"],"who_is_affected":"Sites running the PayDunya WooCommerce Payment Gateway plugin version 1.1.6 or earlier are exposed, and the unconfigured state is the most dangerous one. Stores that have set up the gateway with their keys are less exposed, though the sources say verification is missing in general. Stores that do not use this plugin can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000724,"input_tokens":3350,"output_tokens":779,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-103359':12A,15A '-2026':11A,14A '1.1.6':31B,80C 'allow':110C 'anyon':107C 'arbitrari':65B,115C 'attack':57B,112C 'authent':85C,96C 'check':45B 'complet':71B,121C 'comput':50B,109C 'configur':43B,95C 'cve':10A,13A 'deriv':101C 'empti':53B,104C 'forg':4A,61B 'gateway':27B,41B,76C,93C 'host':20B 'incom':35B,87C 'mark':7A,64B,114C 'notic':6A 'notif':37B,62B,89C 'order':8A,67B,117C 'packag':16B 'paid':9A,69B,119C 'paydunya':1A,17B,24B,73C 'payment':5A,26B,36B,75C,88C 'plugin':3A,29B,78C 'secret':54B,105C 'self':19B 'self-host':18B 'send':59B 'unauthent':56B,111C 'valu':49B,100C 'verifi':34B,83C 'woocommerc':2A,21B,25B,66B,74C,116C 'wordpress':22B,28B,77C","nicknames":[],"mitigations":[],"who_affected":"Sites running the PayDunya WooCommerce Payment Gateway plugin version 1.1.6 or earlier are exposed, and the unconfigured state is the most dangerous one. Stores that have set up the gateway with their keys are less exposed, though the sources say verification is missing in general. Stores that do not use this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T07:16:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103359","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103359","severity":null,"published_at":"2026-10-27T07:16:31+00:00","modified_at":"2026-10-27T07:16:31+00:00","first_seen_at":"2026-10-27T07:30:43+00:00","fetched_at":"2026-10-27T07:30:43+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}