{"id":"CVE-2026-103381","kind":"vulnerability","aliases":["CVE-2026-103381"],"related":[],"title":"Mintpay for WooCommerce: unauthenticated callback marks orders paid and leaks customer data","description":"The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes, allowing unauthenticated attackers to mark arbitrary orders as paid, to cancel arbitrary orders, and to disclose order details including customer contact information.","summary":"The Mintpay for WooCommerce WordPress plugin through 2.2.3 accepts payment callbacks without verifying they are authentic. An unauthenticated attacker can mark arbitrary orders as paid, cancel orders, and read order details including customer contact information.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","payments","woocommerce","wordpress"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check the installed Mintpay for WooCommerce plugin version in the WordPress admin under Plugins; versions through `2.2.3` are affected.\n- Confirm whether the plugin's payment callback endpoint is reachable from the internet.","fix":"- Update the Mintpay for WooCommerce plugin to a version later than `2.2.3` once a fixed release is confirmed by the vendor; the sources do not name a fixed version.\n- Until patched, unknown whether disabling the Mintpay gateway or restricting callback access is sufficient; the sources do not say.","status":"open","published_at":"2026-10-26T07:17:07+00:00","first_seen_at":"2026-10-26T07:28:49+00:00","triaged_at":"2026-10-26T07:30:02+00:00","updated_at":"2026-10-26T07:30:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T07:30:02Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Mintpay for WooCommerce plugin to a version later than `2.2.3` once a fixed release is confirmed by the vendor; the sources do not name a fixed version.\n- Until patched, unknown whether disabling the Mintpay gateway or restricting callback access is sufficient; the sources do not say.","reach":"internet","title":"Mintpay for WooCommerce: unauthenticated callback marks orders paid and leaks customer data","impact":"medium","summary":"The Mintpay for WooCommerce WordPress plugin through 2.2.3 accepts payment callbacks without verifying they are authentic. An unauthenticated attacker can mark arbitrary orders as paid, cancel orders, and read order details including customer contact information.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","ecommerce","payments"],"confidence":0.6,"needs_auth":"no","worst_case":"Attackers mark orders paid and read customer contact details.","analyst_note":"Find the fixed plugin version and vendor advisory; the NVD entry alone does not give a fix or exposure check.","how_to_check":"- Check the installed Mintpay for WooCommerce plugin version in the WordPress admin under Plugins; versions through `2.2.3` are affected.\n- Confirm whether the plugin's payment callback endpoint is reachable from the internet.","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"Sites running the Mintpay for WooCommerce plugin version 2.2.3 or earlier that accept payments through Mintpay are exposed, because the unverified callback is what changes order status. Stores that do not use this plugin, or that run a patched version, can skip it. Whether the callback is reachable without any special setup is not stated by the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000664,"input_tokens":3315,"output_tokens":666,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-103381':15A,18A '-2026':14A,17A '2.2.3':31B,66C 'accept':32B 'allow':78C 'arbitrari':45B,83C,89C 'attack':42B,80C 'authent':39B,71C 'callback':5A,34B,75C 'cancel':49B,88C 'contact':57B,98C 'custom':11A,56B,97C 'cve':13A,16A 'data':12A 'detail':54B,95C 'disclos':93C 'ecommerc':19B 'includ':55B,96C 'inform':58B,99C 'leak':10A 'mark':6A,44B,82C 'mintpay':1A,25B,60C 'order':7A,46B,50B,53B,84C,90C,94C 'packag':20B 'paid':8A,48B,86C 'payment':21B,33B,74C 'plugin':29B,64C 'process':77C 'read':52B 'unauthent':4A,41B,79C 'verifi':36B,69C 'without':35B 'woocommerc':3A,22B,27B,62C 'wordpress':23B,28B,63C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Mintpay for WooCommerce plugin version 2.2.3 or earlier that accept payments through Mintpay are exposed, because the unverified callback is what changes order status. Stores that do not use this plugin, or that run a patched version, can skip it. Whether the callback is reachable without any special setup is not stated by the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T07:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103381","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103381","severity":null,"published_at":"2026-10-26T07:17:07+00:00","modified_at":"2026-10-26T07:17:07+00:00","first_seen_at":"2026-10-26T07:28:49+00:00","fetched_at":"2026-10-26T07:28:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}