CVE-2026-103324: Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Project Secret
The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mark arbitrary orders as paid, or force them to failed.
Affected Software
Event History
Frequently Asked Questions
Which installations are exposed?
Installations running Cardinity Payment Gateway for WooCommerce versions 3.2.6 through 3.4.1 are affected. The issue is reachable over the network and requires no authentication or user interaction.
What does an attacker need to exploit this issue?
An attacker can exploit the issue by forging a payment notification because the notification-signing project secret is empty by default. No WordPress account or other privileges are required.
What is the likely impact on orders?
An attacker can cause arbitrary orders to be marked as paid or force them into a failed state. The provided impact assessment identifies integrity impact, with no stated confidentiality or availability impact.
Does the default configuration contribute to exploitation?
Yes. The project secret used to sign payment notifications is empty by default, preventing effective authenticity verification of those notifications.
What version resolves the issue?
The vulnerability affects versions before 3.4.2, so upgrading to version 3.4.2 or later addresses the affected version range described.