CVE-2026-106027 · Package
NO FIX YET · SEE WHAT TO DO
The Oxygen MyData for WooCommerce WordPress plugin has a payment callback that lacks authorisation and request authenticity checks. An unauthenticated attacker can mark arbitrary WooCommerce orders as completed.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Online stores running WooCommerce with the Oxygen MyData for WooCommerce plugin below version 3.0.9 are exposed, because the payment callback accepts requests without checking they are authorised or genuine. Sites that do not run this plugin can skip it.
Not affected if plugin-not-installed, version-3.0.9-or-later
Who cares self-hosted, woocommerce, wordpress
3.0.9 or laterThe Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.