CVE-2026-103324
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Project Secret
The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mark arbitrary orders as paid, or force them to failed.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Cardinity Payment Gateway for WooCommerce
- Vendor
- Unknown
- Product
- Cardinity Payment Gateway for WooCommerce
- Platforms
- Unknown
- Default status
unaffected- Package collection
- https://wordpress.org/plugins
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 3.2.6 | affected | semver | 3.4.2 | Unavailable | None listed |