---
id: "CVE-2026-103381"
kind: "vulnerability"
aliases: ["CVE-2026-103381"]
title: "Mintpay for WooCommerce: unauthenticated callback marks orders paid and leaks customer data"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "package", "payments", "woocommerce", "wordpress"]
not_affected_if: ["patched-version", "plugin-not-installed"]
published_at: "2026-10-26T07:17:07+00:00"
first_seen_at: "2026-10-26T07:28:49+00:00"
updated_at: "2026-10-26T07:30:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103381", "first_seen_at": "2026-10-26T07:28:49+00:00"}]
---

# Mintpay for WooCommerce: unauthenticated callback marks orders paid and leaks customer data

The Mintpay for WooCommerce WordPress plugin through 2.2.3 accepts payment callbacks without verifying they are authentic. An unauthenticated attacker can mark arbitrary orders as paid, cancel orders, and read order details including customer contact information.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Mintpay for WooCommerce plugin version in the WordPress admin under Plugins; versions through `2.2.3` are affected.
- Confirm whether the plugin's payment callback endpoint is reachable from the internet.

## Fix

- Update the Mintpay for WooCommerce plugin to a version later than `2.2.3` once a fixed release is confirmed by the vendor; the sources do not name a fixed version.
- Until patched, unknown whether disabling the Mintpay gateway or restricting callback access is sufficient; the sources do not say.

## Timeline

- 2026-10-26T07:28:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103381

## From the sources

The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes, allowing unauthenticated attackers to mark arbitrary orders as paid, to cancel arbitrary orders, and to disclose order details including customer contact information.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_