CVE-2026-103319
5.3 MEDIUMPublished 2026-10-26 · Updated 2026-10-26
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid, cancelled or failed.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-287
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2025-43936
- MEDIUMCVE-2026-100143
- HIGHCVE-2026-100163
- UNSCOREDCVE-2026-100169PoC
- HIGHCVE-2026-100606PoC
- HIGHCVE-2026-100607PoC
- HIGHCVE-2026-100684PoC
- HIGHCVE-2026-100709PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.