CVE-2026-103308
Visma Pay for WooCommerce < 1.2.2 - Unauthenticated Payment Bypass and Order Data Disclosure via Gateway Return Endpoint
- State
- Published
- Severity
- 6.5 Medium
- Published
- Oct 14, 2026
- Updated
- Oct 14, 2026
- Reserved
- Sep 30, 2026
Description
The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which has not entered its credentials, allowing unauthenticated attackers to mark arbitrary orders as paid and to disclose the name, email address and postal address of any order's customer.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | WPScan |
Weaknesses
- CWE-345 Insufficient Verification of Data Authenticity
Affected Products
| Product | Versions |
|---|---|
Visma Pay for WooCommerceUnknown |
|
References
- https://wpscan.com/vulnerability/26bae5f0-510b-403e-bd69-c4aa2392406d/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.