---
id: "CVE-2026-103359"
kind: "vulnerability"
aliases: ["CVE-2026-103359"]
title: "PayDunya WooCommerce plugin: forged payment notices mark orders paid"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "paydunya", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["other-payment-gateway", "plugin-not-installed"]
published_at: "2026-10-27T07:16:31+00:00"
first_seen_at: "2026-10-27T07:30:43+00:00"
updated_at: "2026-10-27T07:32:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103359", "first_seen_at": "2026-10-27T07:30:43+00:00"}]
---

# PayDunya WooCommerce plugin: forged payment notices mark orders paid

The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify incoming payment notifications, and before the gateway is configured it checks them against a value computed from an empty secret. An unauthenticated attacker can send a forged notification and mark arbitrary WooCommerce orders as paid and completed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in WordPress admin under Plugins, or with `wp plugin get paydunya-woocommerce --field=version` if the slug matches.
- Check whether the PayDunya gateway has been configured with its live keys in WooCommerce > Settings > Payments.
- Review recent WooCommerce orders marked completed with no matching PayDunya payment record.

## Fix

- Update the PayDunya WooCommerce Payment Gateway plugin to a version later than `1.1.6` once a fixed release is available; the sources do not name the fixed version.
- Configure the PayDunya gateway with its keys until a fixed release is installed, since the empty-secret check only applies before configuration.
- Audit orders marked paid and completed that have no matching PayDunya transaction.

## Timeline

- 2026-10-27T07:30:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103359

## From the sources

The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming payment notifications and, until the gateway is configured, authenticates them with a value derived from an empty secret that anyone can compute, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid and completed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_