CVE-2026-103298: CCAvenue Payment Gateway for WooCommerce <= 3.1 - Unauthenticated Order Payment Completion via Webhook Forgery
The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install, allowing unauthenticated attackers to forge a confirmation and mark any WooCommerce order as paid without payment.
Affected Software
Event History
Frequently Asked Questions
Are default installations affected?
Yes. On a default installation, the plugin derives its verification key from an empty value, which enables forged payment-confirmation requests.
What does an attacker need to exploit this issue?
An attacker does not need to authenticate. They need to send a forged payment-confirmation request that causes a WooCommerce order to be marked as paid without a real payment.
What is the practical impact of successful exploitation?
An attacker can mark any WooCommerce order as paid without payment, potentially allowing fulfillment of goods or services for unpaid orders.