{"id":"CVE-2026-103382","kind":"vulnerability","aliases":["CVE-2026-103382"],"related":[],"title":"Casso Flow WordPress plugin: forged payment notices mark WooCommerce orders paid","description":"The Casso Flow  WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation, allowing unauthenticated attackers to forge a notification and mark any pending WooCommerce order as paid, regardless of its payment method.","summary":"The Casso Flow WordPress plugin before 4.2.0 accepts bank-transfer payment notifications without checking them, because its verification token is empty on a default install. An unauthenticated attacker can send a forged notification and mark any pending WooCommerce order as paid.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","payments","self-hosted","woocommerce","wordpress"],"not_affected_if":["no-casso-flow-plugin","plugin-4.2.0-or-later"],"how_to_check":"- Check the installed Casso Flow plugin version in the WordPress admin under Plugins; affected if below `4.2.0`\n- Check whether the verification token field in the Casso Flow settings is empty\n- unknown for other checks; the sources do not say","fix":"- Update the Casso Flow WordPress plugin to `4.2.0` or later\n- Set a non-empty verification token in the plugin settings if the update cannot be applied right away\n- Review recent WooCommerce orders marked paid without a matching bank transfer","status":"open","published_at":"2026-10-28T06:16:32+00:00","first_seen_at":"2026-10-28T06:31:26+00:00","triaged_at":"2026-10-28T06:32:57+00:00","updated_at":"2026-10-28T06:32:57+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T06:32:57Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Casso Flow WordPress plugin to `4.2.0` or later\n- Set a non-empty verification token in the plugin settings if the update cannot be applied right away\n- Review recent WooCommerce orders marked paid without a matching bank transfer","reach":"internet","title":"Casso Flow WordPress plugin: forged payment notices mark WooCommerce orders paid","impact":"medium","summary":"The Casso Flow WordPress plugin before 4.2.0 accepts bank-transfer payment notifications without checking them, because its verification token is empty on a default install. An unauthenticated attacker can send a forged notification and mark any pending WooCommerce order as paid.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted","payments"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker marks unpaid orders as paid, bypassing payment","analyst_note":"Confirm the exact fixed version and whether the token default is still empty in releases; the NVD entry alone gives no CVSS score or vendor advisory.","how_to_check":"- Check the installed Casso Flow plugin version in the WordPress admin under Plugins; affected if below `4.2.0`\n- Check whether the verification token field in the Casso Flow settings is empty\n- unknown for other checks; the sources do not say","needs_analyst":true,"not_affected_if":["plugin-4.2.0-or-later","no-casso-flow-plugin"],"who_is_affected":"Sites running the Casso Flow WordPress plugin before 4.2.0 with WooCommerce that accept bank-transfer payments through it. The exposure depends on the token being empty, which the sources describe as the default installation state. Sites on 4.2.0 or later, or without this plugin, are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000662,"input_tokens":3321,"output_tokens":660,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-103382':14A,17A '-2026':13A,16A '4.2.0':31B,73C 'accept':32B 'allow':97C 'attack':53B,99C 'authent':77C 'bank':34B,80C 'bank-transf':33B,79C 'casso':1A,26B,68C 'check':39B 'cve':12A,15A 'default':49B,95C 'empti':46B,92C 'flow':2A,27B,69C 'forg':5A,57B,101C 'host':22B 'incom':78C 'instal':50B,96C 'mark':8A,60B,105C 'method':116C 'notic':7A 'notif':37B,58B,83C,103C 'order':10A,64B,109C 'packag':18B 'paid':11A,66B,111C 'payment':6A,19B,36B,82C,115C 'pend':62B,107C 'plugin':4A,29B,71C 'proper':76C 'regardless':112C 'self':21B 'self-host':20B 'send':55B 'token':44B,86C 'transfer':35B,81C 'unauthent':52B,98C 'use':87C 'verif':43B 'verifi':89C 'without':38B 'woocommerc':9A,23B,63B,108C 'wordpress':3A,24B,28B,70C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Casso Flow WordPress plugin before 4.2.0 with WooCommerce that accept bank-transfer payments through it. The exposure depends on the token being empty, which the sources describe as the default installation state. Sites on 4.2.0 or later, or without this plugin, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103382","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103382","severity":null,"published_at":"2026-10-28T06:16:32+00:00","modified_at":"2026-10-28T06:16:32+00:00","first_seen_at":"2026-10-28T06:31:26+00:00","fetched_at":"2026-10-28T06:31:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}