Live › vulnerability › CVE-2026-103372
Go to dashboardThe Payconiq WordPress plugin through version 1.0.4 returns an order confirmation link without checking whether the visitor may see that order. An unauthenticated visitor can obtain any paid order's key and, for recent guest orders, read the customer's personal details.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the Payconiq WordPress plugin version 1.0.4 or earlier that take orders through it are exposed, since the flaw sits in the order confirmation path. Sites without this plugin, or with it removed, are not affected. The sources do not say whether a non-default configuration is required.
No product ranges from the sources yet.
1.0.4 or earlier in the WordPress plugins screen or wp plugin get payconiq1.0.4, if one is available; the sources do not name a fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning its confirmation link, allowing unauthenticated users to obtain any paid order's key and, for recent guest orders, view the customer's personal details.
This page as .md · .json · in your agent: get_signal("CVE-2026-103372")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.