CVE-2026-103361 · Package
NO FIX YET · SEE WHAT TO DO
The Payment Gateway via Valitor for WooCommerce plugin before 1.9.41 checks payment callbacks against a verification secret that ships with a hard-coded default. An unauthenticated attacker can forge a payment confirmation and mark any order as paid.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Stores running the Payment Gateway via Valitor for WooCommerce WordPress plugin before 1.9.41 that have not changed the default verification secret. Stores on 1.9.41 or later, or with a custom secret, are not exposed by this description.
Not affected if custom-secret, plugin-1.9.41-or-later
Who cares ecommerce, valitor, woocommerce, wordpress
1.9.41 or later. Fixed version from the description; the sources give no further detail.The Payment Gateway via Valitor for WooCommerce WordPress plugin before 1.9.41 does not properly validate the authenticity of payment callbacks, relying on a verification secret that ships with a hard-coded default value used by every store that has not changed it, allowing unauthenticated attackers to forge a valid payment confirmation and mark arbitrary orders as paid.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.