{"id":"CVE-2026-105970","kind":"vulnerability","aliases":["CVE-2026-105970"],"related":[],"title":"WordPress QR payment plugin accepts forged bank notices, marking orders paid","description":"The Thanh Toán Quét Mã QR Code Tự Động  WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installation, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid.","summary":"The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through version 2.0.1 does not verify that incoming bank-transfer payment notifications are genuine. An unauthenticated attacker can mark arbitrary WooCommerce orders as paid without paying.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang","fixed":[],"affected":"<= 2.0.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","vietnam-payments","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- WordPress admin > Plugins: look for 'Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam' (slug bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang), version 2.0.1 or lower. 2.0.1 is the latest release, so every install is in range.\n- Or run: wp plugin list --name=bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang\n- Review recent WooCommerce orders marked paid by this gateway with no matching bank statement entry.","fix":"No fixed version. Latest release is 2.0.1 and wordpress.org closed the plugin on Oct 23, 2026 (described as temporary, pending review). Deactivate and remove the plugin, or switch to a maintained bank-transfer gateway, until a patched release exists.","status":"open","published_at":"2026-11-08T06:17:04+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","triaged_at":"2026-11-08T06:47:22+00:00","updated_at":"2026-11-08T06:48:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T06:47:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress QR payment plugin accepts forged bank notices, marking orders paid","impact":"medium","summary":"The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through version 2.0.1 does not verify that incoming bank-transfer payment notifications are genuine. An unauthenticated attacker can mark arbitrary WooCommerce orders as paid without paying.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","vietnam-payments"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker marks unpaid WooCommerce orders as paid remotely","analyst_note":"Find the plugin's fixed version and vendor advisory; the NVD entry gives no fixed version or patch status for this plugin.","how_to_check":"- Check whether the plugin `Thanh Toán Quét Mã QR Code Tự Động` is installed and its version is `2.0.1` or lower in the WordPress plugins list.\n- Check whether WooCommerce is in use with this plugin's bank-transfer payment method enabled.\n- unknown for any further check: the sources do not name a configuration file or setting to inspect.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WordPress plugin through 2.0.1 with WooCommerce orders paid by bank transfer through it. The sources describe the flaw as present on a default installation, so no special configuration is stated as required. Sites without this plugin are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000768,"input_tokens":4562,"output_tokens":624,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the plugin's fixed version and vendor advisory; the NVD entry gives no fixed version or patch status for this plugin.","search":"'-105970':14A,17A '-2026':13A,16A '2.0.1':49B,86C 'accept':5A 'allow':104C 'arbitrari':67B,109C 'attack':64B,106C 'authent':92C 'bank':7A,56B,96C 'bank-transf':55B,95C 'bck':19A 'bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang':18A 'chuyen':26A 'code':42B,80C 'cve':12A,15A 'default':102C 'dong':21A 'forg':6A 'genuin':61B 'hang':29A 'incom':54B,94C 'instal':103C 'khoan':27A 'mark':9A,66B,108C 'mã':40B,78C 'ngan':28A 'nhan':23A 'notic':8A 'notif':59B,99C 'order':10A,69B,111C 'packag':30B 'paid':11A,71B,113C 'pay':73B 'payment':3A,33B,58B,98C 'plugin':4A,46B,84C 'proper':89C 'qr':2A,41B,79C 'quét':39B,77C 'thanh':24A,37B,75C 'toan':25A 'toán':38B,76C 'transfer':57B,97C 'tu':20A 'tự':43B,81C 'unauthent':63B,105C 'verifi':52B,90C 'version':48B 'vietnam':32B 'vietnam-pay':31B 'without':72B 'woocommerc':34B,68B,110C 'wordpress':1A,35B,45B,83C 'xac':22A 'động':44B,82C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WordPress plugin through 2.0.1 with WooCommerce orders paid by bank transfer through it. The sources describe the flaw as present on a default installation, so no special configuration is stated as required. Sites without this plugin are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["bcktudongxacnhanthanhtoanchuyenkhoannganhang"],"ptokens":["bck","chuyen","dong","hang","khoan","ngan","nhan","thanh","toan","tu","xac"],"labels":["high","package","vietnampayments","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-105970':14A,17A '-2026':13A,16A 'accept':5A 'bank':7A 'bck':19A 'bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang':18A 'chuyen':26A 'cve':12A,15A 'dong':21A 'forg':6A 'hang':29A 'khoan':27A 'mark':9A 'ngan':28A 'nhan':23A 'notic':8A 'order':10A 'paid':11A 'payment':3A 'plugin':4A 'qr':2A 'thanh':24A 'toan':25A 'tu':20A 'wordpress':1A 'xac':22A","search_b":"'2.0.1':49B 'arbitrari':67B 'attack':64B 'bank':56B 'bank-transf':55B 'code':42B 'genuin':61B 'incom':54B 'mark':66B 'mã':40B 'notif':59B 'order':69B 'packag':30B 'paid':71B 'pay':73B 'payment':33B,58B 'plugin':46B 'qr':41B 'quét':39B 'thanh':37B 'toán':38B 'transfer':57B 'tự':43B 'unauthent':63B 'verifi':52B 'version':48B 'vietnam':32B 'vietnam-pay':31B 'without':72B 'woocommerc':34B,68B 'wordpress':35B,45B 'động':44B","search_c":"'2.0.1':86C 'allow':104C 'arbitrari':109C 'attack':106C 'authent':92C 'bank':96C 'bank-transf':95C 'code':80C 'default':102C 'incom':94C 'instal':103C 'mark':108C 'mã':78C 'notif':99C 'order':111C 'paid':113C 'payment':98C 'plugin':84C 'proper':89C 'qr':79C 'quét':77C 'thanh':75C 'toán':76C 'transfer':97C 'tự':81C 'unauthent':105C 'verifi':90C 'woocommerc':110C 'wordpress':83C 'động':82C","cause_entry":null,"cause_path":null,"first_public_at":"2026-11-08T06:17:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105970","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105970","severity":null,"published_at":"2026-11-08T06:17:04+00:00","modified_at":"2026-11-08T06:17:04+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","fetched_at":"2026-11-08T06:46:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105970:2169","url":"https://wordpress.org/plugins/bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/","severity":null,"published_at":"2026-11-08T06:48:49+00:00","modified_at":"2026-11-08T06:48:49+00:00","first_seen_at":"2026-11-08T06:48:49+00:00","fetched_at":"2026-11-08T06:48:49+00:00","note":"NVD only (no vendor advisory found). wordpress.org page: latest 2.0.1, plugin closed Oct 23 2026 pending review, so no fix exists. Not to be confused with CVE-2024-8914 (stored XSS, same plugin, same <=2.0.1). Nothing verified: the wordpress.org page does not mention this flaw; the no-fix status is inferred from the closure.","cites":["https://wordpress.org/plugins/bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/","https://nvd.nist.gov/vuln/detail/CVE-2026-105970"]}],"documents":[{"id":100287,"url":"https://wordpress.org/plugins/bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/","title":"wordpress.org plugin page: closed Oct 23, 2026, latest version 2.0.1","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":100288,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105970","title":"NVD CVE-2026-105970","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}