---
id: "CVE-2026-105970"
page: "https://infrastack.ai/live/CVE-2026-105970"
kind: "vulnerability"
aliases: ["CVE-2026-105970"]
title: "WordPress QR payment plugin accepts forged bank notices, marking orders paid"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang", "fixed": [], "affected": "<= 2.0.1", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "vietnam-payments", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-08T06:17:04+00:00"
first_seen_at: "2026-11-08T06:46:21+00:00"
updated_at: "2026-11-08T06:48:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105970", "first_seen_at": "2026-11-08T06:46:21+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105970", "first_seen_at": "2026-11-08T06:48:49+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-105970", "https://wordpress.org/plugins/bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/"]}]
exploit_sources: []
---

# WordPress QR payment plugin accepts forged bank notices, marking orders paid

Link for people: https://infrastack.ai/live/CVE-2026-105970 (this .md is for agents)

The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through version 2.0.1 does not verify that incoming bank-transfer payment notifications are genuine. An unauthenticated attacker can mark arbitrary WooCommerce orders as paid without paying.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang affected <= 2.0.1 fixed no fixed version listed

## How to check

- WordPress admin > Plugins: look for 'Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam' (slug bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang), version 2.0.1 or lower. 2.0.1 is the latest release, so every install is in range.
- Or run: wp plugin list --name=bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang
- Review recent WooCommerce orders marked paid by this gateway with no matching bank statement entry.

## Fix

No fixed version. Latest release is 2.0.1 and wordpress.org closed the plugin on Oct 23, 2026 (described as temporary, pending review). Deactivate and remove the plugin, or switch to a maintained bank-transfer gateway, until a patched release exists.

## Timeline

- 2026-11-08T06:46:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105970
- 2026-11-08T06:48:49+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-105970 — NVD only (no vendor advisory found). wordpress.org page: latest 2.0.1, plugin closed Oct 23 2026 pending review, so no fix exists. Not to be confused with CVE-2024-8914 (stored XSS, same plugin, same <=2.0.1). Nothing verified: the wordpress.org page does not mention this flaw; the no-fix status is inferred from the closure.

## Documents

- [advisory] NVD CVE-2026-105970 https://nvd.nist.gov/vuln/detail/CVE-2026-105970
- [fix] wordpress.org plugin page: closed Oct 23, 2026, latest version 2.0.1 https://wordpress.org/plugins/bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/

## From the sources

The Thanh Toán Quét Mã QR Code Tự Động  WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installation, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_