BCK-TU-DONG-XAC-NHAN-THANH-TOAN-CHUYEN-KHOAN-NGAN-HANG · CVE-2026-105970 · Package
NO FIX YET · SEE WHAT TO DO
The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through version 2.0.1 does not verify that incoming bank-transfer payment notifications are genuine. An unauthenticated attacker can mark arbitrary WooCommerce orders as paid without paying.
first public Nov 8, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the WordPress plugin through 2.0.1 with WooCommerce orders paid by bank transfer through it. The sources describe the flaw as present on a default installation, so no special configuration is stated as required. Sites without this plugin are not affected.
Not affected if plugin-not-installed
Who cares vietnam-payments, woocommerce, wordpress
2.0.1 and wordpress.org closed the plugin on Oct 23, 2026 (described as temporary, pending review)The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installation, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.