---
id: "CVE-2026-103376"
kind: "vulnerability"
aliases: ["CVE-2026-103376"]
title: "PeachPay WooCommerce plugin leaks order keys to unauthenticated requests"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "package", "payments", "peachpay", "woocommerce", "wordpress"]
not_affected_if: ["plugin-1.120.70-or-later", "plugin-not-installed"]
published_at: "2026-10-17T06:16:30+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:26:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103376", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# PeachPay WooCommerce plugin leaks order keys to unauthenticated requests

The PeachPay payments plugin for WooCommerce, before version 1.120.70, returns an order's secret key to anyone who asks without checking permissions. An attacker can use that key to read the customer's name, email, postal address and order contents for any paid order.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed PeachPay plugin version in the WordPress admin under Plugins, or with `wp plugin get peachpay --field=version` using WP-CLI.
- Confirm whether the site runs WooCommerce with PeachPay enabled as a checkout option.

## Fix

- Update the PeachPay — Payments & Express Checkout for WooCommerce plugin to `1.120.70` or later.
- Review recent orders for unexpected access, and rotate any order keys the site or customers have shared if you suspect exposure.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103376

## From the sources

The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to retrieve the key for any paid order and use it to view that order's customer name, email address, postal address and contents.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_