{"id":"CVE-2026-103376","kind":"vulnerability","aliases":["CVE-2026-103376"],"related":[],"title":"PeachPay WooCommerce plugin leaks order keys to unauthenticated requests","description":"The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to retrieve the key for any paid order and use it to view that order's customer name, email address, postal address and contents.","summary":"The PeachPay payments plugin for WooCommerce, before version 1.120.70, returns an order's secret key to anyone who asks without checking permissions. An attacker can use that key to read the customer's name, email, postal address and order contents for any paid order.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","payments","peachpay","woocommerce","wordpress"],"not_affected_if":["plugin-1.120.70-or-later","plugin-not-installed"],"how_to_check":"- Check the installed PeachPay plugin version in the WordPress admin under Plugins, or with `wp plugin get peachpay --field=version` using WP-CLI.\n- Confirm whether the site runs WooCommerce with PeachPay enabled as a checkout option.","fix":"- Update the PeachPay — Payments & Express Checkout for WooCommerce plugin to `1.120.70` or later.\n- Review recent orders for unexpected access, and rotate any order keys the site or customers have shared if you suspect exposure.","status":"open","published_at":"2026-10-17T06:16:30+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:26:57+00:00","updated_at":"2026-10-25T04:26:57+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:26:57Z","model":"claude-haiku-5-5","output":{"fix":"- Update the PeachPay — Payments & Express Checkout for WooCommerce plugin to `1.120.70` or later.\n- Review recent orders for unexpected access, and rotate any order keys the site or customers have shared if you suspect exposure.","reach":"internet","title":"PeachPay WooCommerce plugin leaks order keys to unauthenticated requests","impact":"medium","summary":"The PeachPay payments plugin for WooCommerce, before version 1.120.70, returns an order's secret key to anyone who asks without checking permissions. An attacker can use that key to read the customer's name, email, postal address and order contents for any paid order.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","peachpay","ecommerce","payments"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker reads customer names, emails, addresses and order contents.","analyst_note":"","how_to_check":"- Check the installed PeachPay plugin version in the WordPress admin under Plugins, or with `wp plugin get peachpay --field=version` using WP-CLI.\n- Confirm whether the site runs WooCommerce with PeachPay enabled as a checkout option.","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-1.120.70-or-later"],"who_is_affected":"Any WordPress site running the PeachPay plugin before 1.120.70 alongside WooCommerce is exposed, because the flaw sits in the public request handler and needs no login. Sites without PeachPay installed, or with it updated, can skip this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000632,"input_tokens":3371,"output_tokens":590,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-103376':12A,15A '-2026':11A,14A '1.120.70':30B,82C 'address':58B,125C,127C 'allow':104C 'anyon':38B,105C 'ask':40B 'attack':45B 'authorize.net':77C 'capabl':87C 'check':42B,90C 'checkout':70C 'content':61B,129C 'custom':53B,122C 'cve':10A,13A 'ecommerc':16B 'email':56B,124C 'express':69C 'key':6A,36B,49B,97C,109C 'leak':4A 'name':55B,123C 'nmi':78C 'order':5A,33B,60B,65B,94C,113C,120C 'ownership':89C 'packag':17B 'paid':64B,112C 'payment':18B,24B,68C 'paypal':75C 'peachpay':1A,19B,23B,67C 'perform':85C 'permiss':43B 'plugin':3A,25B,80C 'postal':57B,126C 'read':51B 'request':9A,103C 'respons':99C 'retriev':107C 'return':31B,92C 'secret':35B,96C 'squar':76C 'stripe':74C 'support':73C 'unauthent':8A,102C 'use':47B,115C 'version':29B 'view':118C 'without':41B 'woocommerc':2A,20B,27B,72C 'wordpress':21B,79C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the PeachPay plugin before 1.120.70 alongside WooCommerce is exposed, because the flaw sits in the public request handler and needs no login. Sites without PeachPay installed, or with it updated, can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T06:16:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103376","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103376","severity":null,"published_at":"2026-10-17T06:16:30+00:00","modified_at":"2026-10-19T21:02:51+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}