Vulnerability record/PUBLISHED/Published Nov 15, 2026 06:00:06 UTC
CVE-2026-103361
The Payment Gateway via Valitor for WooCommerce WordPress plugin before 1.9.41 does not properly validate the authenticity of payment callbacks, relying on a verification secret that ships with a hard-coded default value used by every store that has not changed it, allowing unauthenticated attackers to forge a valid payment confirmation and mark arbitrary orders as paid.
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedNov 15, 2026 06:00:06 UTC
PublishedNov 15, 2026 06:00:06 UTC
ReservedSep 30, 2026 12:50:01 UTC
Credits
- Naoki Kawahigashi
- WPScan