Live › vulnerability › CVE-2026-103381
Go to dashboardThe Mintpay for WooCommerce WordPress plugin through 2.2.3 accepts payment callbacks without verifying they are authentic. An unauthenticated attacker can mark arbitrary orders as paid, cancel orders, and read order details including customer contact information.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 07:28 UTC. All times on this page are UTC.
Sites running the Mintpay for WooCommerce plugin version 2.2.3 or earlier that accept payments through Mintpay are exposed, because the unverified callback is what changes order status. Stores that do not use this plugin, or that run a patched version, can skip it. Whether the callback is reachable without any special setup is not stated by the sources.
No product ranges from the sources yet.
2.2.3 are affected.2.2.3 once a fixed release is confirmed by the vendor; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes, allowing unauthenticated attackers to mark arbitrary orders as paid, to cancel arbitrary orders, and to disclose order details including customer contact information.
This page as .md · .json · in your agent: get_signal("CVE-2026-103381")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.