CVE-2026-103299
CVE-2026-103299 · nexi Alpha Bank for WooCommerce <= 2.2.0 - Unauthenticated Payment Confirmation Forgery via Empty Shared Secret
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the secret has not been set, and the same callback lets them move any pending order to a failed state whether or not the secret is configured.
EPSS 0,1%
- Publicación
- Actualización
Productos y versiones afectados
payment gateway
- Versiones
- ≥ 0, ≤ 2.2.0: Afectada (semver)
Sin corrección publicada