Live › vulnerability › CVE-2026-103376
Go to dashboardThe PeachPay payments plugin for WooCommerce, before version 1.120.70, returns an order's secret key to anyone who asks without checking permissions. An attacker can use that key to read the customer's name, email, postal address and order contents for any paid order.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any WordPress site running the PeachPay plugin before 1.120.70 alongside WooCommerce is exposed, because the flaw sits in the public request handler and needs no login. Sites without PeachPay installed, or with it updated, can skip this.
No product ranges from the sources yet.
wp plugin get peachpay --field=version using WP-CLI.1.120.70 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to retrieve the key for any paid order and use it to view that order's customer name, email address, postal address and contents.
This page as .md · .json · in your agent: get_signal("CVE-2026-103376")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.