CVE-2026-103301: Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret
The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because the secret used to sign them is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary WooCommerce orders as paid. The same handler also marks an attacker-chosen order as failed when given an invalid signature.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to forged payment confirmations?
Sites using Payment Gateway for Telcell versions before 2.0.5 are exposed when the merchant secret remains at its empty default. An unauthenticated remote attacker can then submit a forged payment notification that is accepted as valid.
What can an attacker do with a forged or invalid notification?
A forged valid notification can mark an arbitrary WooCommerce order as paid. A notification with an invalid signature can also cause an attacker-chosen order to be marked as failed.
Does exploiting this require an account or user interaction?
No. The issue is remotely exploitable without authentication or user interaction.