CVE-2026-103381
CVE-2026-103381 · Mintpay <= 2.2.3 - Unauthenticated Order Payment Completion and Cancellation via Callback Forgery
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes, allowing unauthenticated attackers to mark arbitrary orders as paid, to cancel arbitrary orders, and to disclose order details including customer contact information.
CVSS 6.5 · Moyenne · EPSS 0,2%
- Publication
- Mise à jour
Produits et versions concernés
mintpay for woocommerce
- Versions du logiciel
- ≥ 0, ≤ 2.2.3: Concernée (semver)
Aucun correctif publié