CVE-2026-103312: Payment Integration Wompi <= 4.0.1 - Unauthenticated Payment Confirmation Forgery via IPN Callback
The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment notifications on a stock install, because the callback's checksum is keyed on a merchant secret that is empty until it is manually configured, allowing an unauthenticated attacker to forge a notification and mark an arbitrary order as paid.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Manually configure the merchant secret used to key the callback checksum; do not leave it empty.
Payment Integration Wompi WordPress plugin merchant secret = configured with a non-empty secret
Event History
Frequently Asked Questions
Which installations are exposed by default?
Stock installations are exposed when the merchant secret has not been manually configured. In that state, the callback checksum is keyed with an empty secret and incoming payment notifications are not authenticated.
What does an attacker need to exploit this issue?
An attacker does not need authentication. They need to submit a forged payment notification through the IPN callback for an order they want marked as paid.
What is the impact of a successful forged notification?
A successful forgery can cause an arbitrary order to be marked as paid.
What can be done if updating is not immediately possible?
Manually configure a non-empty merchant secret so the callback checksum is not keyed with an empty value. Review orders marked as paid for potentially forged payment notifications.