CVE-2026-103308: Visma Pay for WooCommerce < 1.2.2 - Unauthenticated Payment Bypass and Order Data Disclosure via Gateway Return Endpoint
The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which has not entered its credentials, allowing unauthenticated attackers to mark arbitrary orders as paid and to disclose the name, email address and postal address of any order's customer.
Affected Software
Event History
Frequently Asked Questions
Which stores are exposed to unauthenticated exploitation?
Stores using a version before 1.2.2 are exposed when Visma Pay merchant credentials have not been entered, leaving the merchant secret empty. In that state, an unauthenticated remote attacker can exploit the gateway return endpoint.
What can an attacker do through the affected endpoint?
An attacker can mark arbitrary orders as paid and disclose the customer name, email address, and postal address associated with any order.
What should be done if upgrading is not immediately possible?
Enter the Visma Pay merchant credentials so that the merchant secret is not empty. This addresses the condition described for unauthenticated exploitation until the plugin can be updated to 1.2.2 or later.
How can administrators determine whether their store is at risk?
Check whether the installed Visma Pay for WooCommerce version is earlier than 1.2.2 and whether Visma Pay merchant credentials have been configured. A vulnerable version combined with missing credentials meets the described exposure condition.