Live › vulnerability › CVE-2026-103382
Go to dashboardThe Casso Flow WordPress plugin before 4.2.0 accepts bank-transfer payment notifications without checking them, because its verification token is empty on a default install. An unauthenticated attacker can send a forged notification and mark any pending WooCommerce order as paid.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the Casso Flow WordPress plugin before 4.2.0 with WooCommerce that accept bank-transfer payments through it. The exposure depends on the token being empty, which the sources describe as the default installation state. Sites on 4.2.0 or later, or without this plugin, are not affected.
No product ranges from the sources yet.
4.2.04.2.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation, allowing unauthenticated attackers to forge a notification and mark any pending WooCommerce order as paid, regardless of its payment method.
This page as .md · .json · in your agent: get_signal("CVE-2026-103382")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.