CVE-2026-103324

5.3 Moyenne

Publiée le 15/10/2026 à 09:17 · Modifiée le 15/10/2026 à 16:47 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mark arbitrary orders as paid, or force them to failed.

Traduire en français

Produits concernés

Unknown Cardinity Payment Gateway for WooCommerce

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.3 Moyenne	contact@wpscan.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-345

Références

https://wpscan.com/vulnerability/4e23c520-bb92-47b8-a617-0d334820db50/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories