CVE-2026-103300: Eurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery via Unverified Callback
The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending order as paid, and to force any order into a failed status without any secret at all.
Affected Software
Event History
Frequently Asked Questions
Which orders can an unauthenticated attacker manipulate?
An attacker can mark any pending order as paid. They can also force any order into a failed status, and this failure-status action requires no secret.
Are default installations affected?
Yes. The plugin ships with the secret used to authenticate payment confirmations empty by default, so payment-confirmation requests are not protected by a configured secret.
What must an attacker have to exploit this issue?
No authentication or user interaction is required. The attacker can send a forged payment-confirmation request because the plugin does not verify that it originated from the payment provider.