CVE-2026-103517

5.3 Moyenne

Publiée le 08/10/2026 à 13:16 · Modifiée le 08/10/2026 à 22:51 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying.

Traduire en français

Produits concernés

Unknown Airwallex Online Payments Gateway

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.3 Moyenne	contact@wpscan.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-345

Références

https://wpscan.com/vulnerability/17179c6d-32e0-4a22-88b4-9768a5f36365/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories