{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-103324",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-103324",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-10-15T06:41:13.914Z",
    "updatedAt": "2026-10-15T11:01:26.948Z",
    "importedAt": "2026-10-24T01:57:50.502Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Project Secret",
      "summary": "The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mark arbitrary orders as paid, or force them to failed.",
      "affected": [
        {
          "vendor": "Unknown",
          "product": "Cardinity Payment Gateway for WooCommerce",
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "3.2.6",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "3.4.2"
            }
          ]
        }
      ]
    }
  }
}