---
id: "CVE-2026-106027"
page: "https://infrastack.ai/live/CVE-2026-106027"
kind: "vulnerability"
aliases: ["CVE-2026-106027"]
title: "Oxygen MyData for WooCommerce: unauthenticated users can mark orders completed"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-3.0.9-or-later"]
published_at: "2026-11-12T06:17:10+00:00"
first_seen_at: "2026-11-12T06:36:50+00:00"
updated_at: "2026-11-12T06:38:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106027", "first_seen_at": "2026-11-12T06:36:50+00:00"}]
exploit_sources: []
---

# Oxygen MyData for WooCommerce: unauthenticated users can mark orders completed

Link for people: https://infrastack.ai/live/CVE-2026-106027 (this .md is for agents)

The Oxygen MyData for WooCommerce WordPress plugin has a payment callback that lacks authorisation and request authenticity checks. An unauthenticated attacker can mark arbitrary WooCommerce orders as completed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Oxygen MyData for WooCommerce plugin is installed and its version in the WordPress admin plugins list
- Look for the plugin's payment callback endpoints on the store and confirm whether they are reachable without authentication

## Fix

- Oxygen MyData for WooCommerce: upgrade to `3.0.9` or later

## Timeline

- 2026-11-12T06:36:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106027

## From the sources

The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_