CVE-2026-103319: OPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Confirmation Forgery via Empty Default Secret Key

Q: Which installations are most exposed?

Installations using OPay Payment Gateway for WooCommerce through version 2.5.5 are exposed when the payment-notification signature secret remains at its empty default value.

Q: What does an attacker need to exploit this issue?

An attacker does not need to authenticate. They can forge a payment notification that passes validation because the default secret used for signature verification is empty.

Q: What can a successful forgery do to orders?

A forged notification can mark arbitrary orders as paid, cancelled, or failed.

Q: What should be checked while remediation is pending?

Check whether the plugin's payment-notification signature secret is still empty and review order status changes for unexpected paid, cancelled, or failed transitions.

Published Oct 26, 2026

Updated

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid, cancelled or failed.

Affected Software

1 affected component

OPay OPay Payment Gateway for WooCommerce<=2.5.5

Event History

Oct 26, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which installations are most exposed?

Installations using OPay Payment Gateway for WooCommerce through version 2.5.5 are exposed when the payment-notification signature secret remains at its empty default value.

What does an attacker need to exploit this issue?

An attacker does not need to authenticate. They can forge a payment notification that passes validation because the default secret used for signature verification is empty.

What can a successful forgery do to orders?

A forged notification can mark arbitrary orders as paid, cancelled, or failed.

What should be checked while remediation is pending?

Check whether the plugin's payment-notification signature secret is still empty and review order status changes for unexpected paid, cancelled, or failed transitions.

CVE-2026-103319: OPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Confirmation Forgery via Empty Default Secret Key

Affected Software

Event History

Frequently Asked Questions

Which installations are most exposed?

What does an attacker need to exploit this issue?

What can a successful forgery do to orders?

What should be checked while remediation is pending?

Company

Resources

Contact

Frequently Asked Questions

Which installations are most exposed?

What does an attacker need to exploit this issue?

What can a successful forgery do to orders?

What should be checked while remediation is pending?