CVE-2026-103299: nexi Alpha Bank for WooCommerce <= 2.2.0 - Unauthenticated Payment Confirmation Forgery via Empty Shared Secret

Q: Which installations are exposed to forged payment confirmations?

Installations running the plugin through 2.2.0 are exposed if the shared secret for the bank payment-notification callback has not been configured. In that condition, an unauthenticated attacker can forge a notification that marks any WooCommerce order as paid.

Q: Can configuring the shared secret fully prevent abuse of the callback?

No. A configured secret prevents the described empty-secret payment-confirmation forgery, but the callback can still be used to move any pending order to a failed state regardless of whether the secret is configured.

Q: What access does an attacker need?

No authentication is required. The issue is reachable through the bank payment-notification callback.

Q: How can I determine whether payment confirmations are at risk?

Check whether the plugin's shared secret is configured for the bank payment-notification callback. If it is unset and the plugin version is 2.2.0 or earlier, orders can be fraudulently marked paid.

Published Oct 26, 2026

Updated

The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the secret has not been set, and the same callback lets them move any pending order to a failed state whether or not the secret is configured.

Affected Software

1 affected component

Nexi Alpha Bank for WooCommerce<=2.2.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Configure the shared secret before using the bank's payment-notification callback for authentication.
nexi Alpha Bank for WooCommerce shared secret = configured

Event History

Oct 26, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which installations are exposed to forged payment confirmations?

Installations running the plugin through 2.2.0 are exposed if the shared secret for the bank payment-notification callback has not been configured. In that condition, an unauthenticated attacker can forge a notification that marks any WooCommerce order as paid.

Can configuring the shared secret fully prevent abuse of the callback?

No. A configured secret prevents the described empty-secret payment-confirmation forgery, but the callback can still be used to move any pending order to a failed state regardless of whether the secret is configured.

What access does an attacker need?

No authentication is required. The issue is reachable through the bank payment-notification callback.

How can I determine whether payment confirmations are at risk?

Check whether the plugin's shared secret is configured for the bank payment-notification callback. If it is unset and the plugin version is 2.2.0 or earlier, orders can be fraudulently marked paid.

CVE-2026-103299: nexi Alpha Bank for WooCommerce <= 2.2.0 - Unauthenticated Payment Confirmation Forgery via Empty Shared Secret

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are exposed to forged payment confirmations?

Can configuring the shared secret fully prevent abuse of the callback?

What access does an attacker need?

How can I determine whether payment confirmations are at risk?

Company

Resources

Contact

Frequently Asked Questions

Which installations are exposed to forged payment confirmations?

Can configuring the shared secret fully prevent abuse of the callback?

What access does an attacker need?

How can I determine whether payment confirmations are at risk?