{"id":"CVE-2026-103361","kind":"vulnerability","aliases":["CVE-2026-103361"],"related":[],"title":"WordPress Valitor payment plugin accepts forged payment confirmations","description":"The Payment Gateway via Valitor for WooCommerce WordPress plugin before 1.9.41 does not properly validate the authenticity of payment callbacks, relying on a verification secret that ships with a hard-coded default value used by every store that has not changed it, allowing unauthenticated attackers to forge a valid payment confirmation and mark arbitrary orders as paid.","summary":"The Payment Gateway via Valitor for WooCommerce plugin before 1.9.41 checks payment callbacks against a verification secret that ships with a hard-coded default. An unauthenticated attacker can forge a payment confirmation and mark any order as paid.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","valitor","woocommerce","wordpress"],"not_affected_if":["custom-secret","plugin-1.9.41-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in the plugin's main file header.\n- Check whether the verification secret in the plugin settings is still the default value.","fix":"- Payment Gateway via Valitor for WooCommerce: move to `1.9.41` or later. Fixed version from the description; the sources give no further detail.","status":"open","published_at":"2026-11-15T07:16:49+00:00","first_seen_at":"2026-11-15T07:36:11+00:00","triaged_at":"2026-11-15T07:36:27+00:00","updated_at":"2026-11-15T07:36:27+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-15T07:36:27Z","model":"claude-haiku-5-5","output":{"fix":"- Payment Gateway via Valitor for WooCommerce: move to `1.9.41` or later. Fixed version from the description; the sources give no further detail.","reach":"internet","title":"WordPress Valitor payment plugin accepts forged payment confirmations","impact":"high","summary":"The Payment Gateway via Valitor for WooCommerce plugin before 1.9.41 checks payment callbacks against a verification secret that ships with a hard-coded default. An unauthenticated attacker can forge a payment confirmation and mark any order as paid.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","valitor","ecommerce"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attackers mark arbitrary orders as paid without paying.","analyst_note":"Confirm the fixed version and the default secret setting from the vendor or NVD entry; the sources give only the description.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in the plugin's main file header.\n- Check whether the verification secret in the plugin settings is still the default value.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-1.9.41-or-later","custom-secret"],"who_is_affected":"Stores running the Payment Gateway via Valitor for WooCommerce WordPress plugin before 1.9.41 that have not changed the default verification secret. Stores on 1.9.41 or later, or with a custom secret, are not exposed by this description.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000746,"input_tokens":4574,"output_tokens":578,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-103361':11A,14A '-2026':10A,13A '1.9.41':29B,69C 'accept':5A 'allow':102C 'arbitrari':113C 'attack':47B,104C 'authent':75C 'callback':32B,78C 'chang':100C 'check':30B 'code':43B,90C 'confirm':8A,52B,110C 'cve':9A,12A 'default':44B,91C 'ecommerc':15B 'everi':95C 'forg':6A,49B,106C 'gateway':22B,61C 'hard':42B,89C 'hard-cod':41B,88C 'mark':54B,112C 'order':56B,114C 'packag':16B 'paid':58B,116C 'payment':3A,7A,21B,31B,51B,60C,77C,109C 'plugin':4A,27B,67C 'proper':72C 'reli':79C 'secret':36B,83C 'ship':38B,85C 'store':96C 'unauthent':46B,103C 'use':93C 'valid':73C,108C 'valitor':2A,17B,24B,63C 'valu':92C 'verif':35B,82C 'via':23B,62C 'woocommerc':18B,26B,65C 'wordpress':1A,19B,66C","nicknames":[],"mitigations":[],"who_affected":"Stores running the Payment Gateway via Valitor for WooCommerce WordPress plugin before 1.9.41 that have not changed the default verification secret. Stores on 1.9.41 or later, or with a custom secret, are not exposed by this description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ecommerce","high","package","valitor","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-103361':11A,14A '-2026':10A,13A 'accept':5A 'confirm':8A 'cve':9A,12A 'forg':6A 'payment':3A,7A 'plugin':4A 'valitor':2A 'wordpress':1A","search_b":"'1.9.41':29B 'attack':47B 'callback':32B 'check':30B 'code':43B 'confirm':52B 'default':44B 'ecommerc':15B 'forg':49B 'gateway':22B 'hard':42B 'hard-cod':41B 'mark':54B 'order':56B 'packag':16B 'paid':58B 'payment':21B,31B,51B 'plugin':27B 'secret':36B 'ship':38B 'unauthent':46B 'valitor':17B,24B 'verif':35B 'via':23B 'woocommerc':18B,26B 'wordpress':19B","search_c":"'1.9.41':69C 'allow':102C 'arbitrari':113C 'attack':104C 'authent':75C 'callback':78C 'chang':100C 'code':90C 'confirm':110C 'default':91C 'everi':95C 'forg':106C 'gateway':61C 'hard':89C 'hard-cod':88C 'mark':112C 'order':114C 'paid':116C 'payment':60C,77C,109C 'plugin':67C 'proper':72C 'reli':79C 'secret':83C 'ship':85C 'store':96C 'unauthent':103C 'use':93C 'valid':73C,108C 'valitor':63C 'valu':92C 'verif':82C 'via':62C 'woocommerc':65C 'wordpress':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T07:16:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103361","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103361","severity":null,"published_at":"2026-11-15T07:16:49+00:00","modified_at":"2026-11-15T07:16:49+00:00","first_seen_at":"2026-11-15T07:36:11+00:00","fetched_at":"2026-11-15T07:36:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}