CVE-2026-103327: Medium severity vulnerability
The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthenticated attackers to mark arbitrary orders as paid or failed without any payment being made.
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated payment-status changes?
CryptoCloud WordPress plugin versions 3.0.0 through 3.0.1 are exposed when the webhook secret remains at its empty default. In that configuration, the gateway callback integrity check is skipped.
What does an attacker need to exploit this issue?
An attacker can send gateway callback notifications without authentication; no payment needs to be made. They can use these notifications to mark arbitrary orders as paid or failed.
What configuration change can reduce exposure if updating is not immediately possible?
Configure a non-empty webhook secret so that the integrity check is not skipped. The described unauthenticated attack condition depends on the webhook secret being left empty.