{"id":"CVE-2026-106027","kind":"vulnerability","aliases":["CVE-2026-106027"],"related":[],"title":"Oxygen MyData for WooCommerce: unauthenticated users can mark orders completed","description":"The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed.","summary":"The Oxygen MyData for WooCommerce WordPress plugin has a payment callback that lacks authorisation and request authenticity checks. An unauthenticated attacker can mark arbitrary WooCommerce orders as completed.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","version-3.0.9-or-later"],"how_to_check":"- Check whether the Oxygen MyData for WooCommerce plugin is installed and its version in the WordPress admin plugins list\n- Look for the plugin's payment callback endpoints on the store and confirm whether they are reachable without authentication","fix":"- Oxygen MyData for WooCommerce: upgrade to `3.0.9` or later","status":"open","published_at":"2026-11-12T06:17:10+00:00","first_seen_at":"2026-11-12T06:36:50+00:00","triaged_at":"2026-11-12T06:38:07+00:00","updated_at":"2026-11-12T06:38:07+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T06:38:07Z","model":"claude-haiku-5-5","output":{"fix":"- Oxygen MyData for WooCommerce: upgrade to `3.0.9` or later","reach":"internet","title":"Oxygen MyData for WooCommerce: unauthenticated users can mark orders completed","impact":"medium","summary":"The Oxygen MyData for WooCommerce WordPress plugin has a payment callback that lacks authorisation and request authenticity checks. An unauthenticated attacker can mark arbitrary WooCommerce orders as completed.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker marks any store order completed without paying","analyst_note":"","how_to_check":"- Check whether the Oxygen MyData for WooCommerce plugin is installed and its version in the WordPress admin plugins list\n- Look for the plugin's payment callback endpoints on the store and confirm whether they are reachable without authentication","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-3.0.9-or-later"],"who_is_affected":"Online stores running WooCommerce with the Oxygen MyData for WooCommerce plugin below version 3.0.9 are exposed, because the payment callback accepts requests without checking they are authorised or genuine. Sites that do not run this plugin can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000722,"input_tokens":4550,"output_tokens":534,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-106027':13A,16A '-2026':12A,15A '3.0.9':59C 'allow':78C 'arbitrari':46B,83C 'attack':43B 'authent':39B,68C 'authoris':36B,64C 'callback':33B,77C 'check':40B 'complet':10A,50B,87C 'cve':11A,14A 'host':20B 'lack':35B 'mark':8A,45B,82C 'mydata':2A,25B,53C 'one':73C 'order':9A,48B,85C 'oxygen':1A,24B,52C 'packag':17B 'payment':32B,76C 'plugin':29B,57C 'proper':63C 'request':38B,71C 'self':19B 'self-host':18B 'unauthent':5A,42B,79C 'user':6A,80C 'valid':66C 'woocommerc':4A,21B,27B,47B,55C,84C 'wordpress':22B,28B,56C","nicknames":[],"mitigations":[],"who_affected":"Online stores running WooCommerce with the Oxygen MyData for WooCommerce plugin below version 3.0.9 are exposed, because the payment callback accepts requests without checking they are authorised or genuine. Sites that do not run this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-106027':13A,16A '-2026':12A,15A 'complet':10A 'cve':11A,14A 'mark':8A 'mydata':2A 'order':9A 'oxygen':1A 'unauthent':5A 'user':6A 'woocommerc':4A","search_b":"'arbitrari':46B 'attack':43B 'authent':39B 'authoris':36B 'callback':33B 'check':40B 'complet':50B 'host':20B 'lack':35B 'mark':45B 'mydata':25B 'order':48B 'oxygen':24B 'packag':17B 'payment':32B 'plugin':29B 'request':38B 'self':19B 'self-host':18B 'unauthent':42B 'woocommerc':21B,27B,47B 'wordpress':22B,28B","search_c":"'3.0.9':59C 'allow':78C 'arbitrari':83C 'authent':68C 'authoris':64C 'callback':77C 'complet':87C 'mark':82C 'mydata':53C 'one':73C 'order':85C 'oxygen':52C 'payment':76C 'plugin':57C 'proper':63C 'request':71C 'unauthent':79C 'user':80C 'valid':66C 'woocommerc':55C,84C 'wordpress':56C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T06:17:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106027","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106027","severity":null,"published_at":"2026-11-12T06:17:10+00:00","modified_at":"2026-11-12T06:17:10+00:00","first_seen_at":"2026-11-12T06:36:50+00:00","fetched_at":"2026-11-12T06:36:50+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}