{"id":"CVE-2026-103372","kind":"vulnerability","aliases":["CVE-2026-103372"],"related":[],"title":"Payconiq WordPress plugin: unauthenticated users can view any paid order","description":"The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning its confirmation link, allowing unauthenticated users to obtain any paid order's key and, for recent guest orders, view the customer's personal details.","summary":"The Payconiq WordPress plugin through version 1.0.4 returns an order confirmation link without checking whether the visitor may see that order. An unauthenticated visitor can obtain any paid order's key and, for recent guest orders, read the customer's personal details.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","payconiq","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the Payconiq plugin is installed and its version is `1.0.4` or earlier in the WordPress plugins screen or `wp plugin get payconiq`\n- unknown","fix":"- Update the Payconiq plugin to a version later than `1.0.4`, if one is available; the sources do not name a fixed version\n- unknown","status":"open","published_at":"2026-10-28T06:16:31+00:00","first_seen_at":"2026-10-28T06:31:26+00:00","triaged_at":"2026-10-28T06:32:57+00:00","updated_at":"2026-10-28T06:32:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T06:32:57Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Payconiq plugin to a version later than `1.0.4`, if one is available; the sources do not name a fixed version\n- unknown","reach":"internet","title":"Payconiq WordPress plugin: unauthenticated users can view any paid order","impact":"medium","summary":"The Payconiq WordPress plugin through version 1.0.4 returns an order confirmation link without checking whether the visitor may see that order. An unauthenticated visitor can obtain any paid order's key and, for recent guest orders, read the customer's personal details.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","payconiq","ecommerce"],"confidence":0.6,"needs_auth":"no","worst_case":"Attackers read customer personal details from recent guest orders","analyst_note":"Confirm the fixed plugin version and whether a patch exists; the NVD entry in the sources gives no version past 1.0.4.","how_to_check":"- Check whether the Payconiq plugin is installed and its version is `1.0.4` or earlier in the WordPress plugins screen or `wp plugin get payconiq`\n- unknown","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Payconiq WordPress plugin version 1.0.4 or earlier that take orders through it are exposed, since the flaw sits in the order confirmation path. Sites without this plugin, or with it removed, are not affected. The sources do not say whether a non-default configuration is required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000611,"input_tokens":3297,"output_tokens":562,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-103372':13A,16A '-2026':12A,15A '1.0.4':28B,69C 'allow':77C,87C 'check':35B,72C 'confirm':32B,85C 'custom':60B,104C 'cve':11A,14A 'detail':63B,107C 'ecommerc':17B 'guest':56B,100C 'key':52B,96C 'link':33B,86C 'may':39B 'obtain':47B,91C 'order':10A,31B,42B,50B,57B,81C,94C,101C 'packag':18B 'paid':9A,49B,93C 'payconiq':1A,19B,23B,65C 'person':62B,106C 'plugin':3A,25B,67C 'read':58B 'recent':55B,99C 'return':29B,83C 'see':40B,79C 'unauthent':4A,44B,88C 'user':5A,89C 'version':27B 'view':7A,102C 'visitor':38B,45B,75C 'whether':36B 'without':34B 'woocommerc':20B 'wordpress':2A,21B,24B,66C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Payconiq WordPress plugin version 1.0.4 or earlier that take orders through it are exposed, since the flaw sits in the order confirmation path. Sites without this plugin, or with it removed, are not affected. The sources do not say whether a non-default configuration is required.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103372","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103372","severity":null,"published_at":"2026-10-28T06:16:31+00:00","modified_at":"2026-10-28T06:16:31+00:00","first_seen_at":"2026-10-28T06:31:26+00:00","fetched_at":"2026-10-28T06:31:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}