CVE-2026-103332: Payex Payment Gateway for WooCommerce <= 1.2.10 - Unauthenticated Payment Confirmation Forgery via Empty-Default Secret Key
The Payex Payment Gateway for Woocommerce WordPress plugin through 1.2.10 does not properly verify the authenticity of incoming payment notifications, relying on a validation secret that is empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark any order as paid.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to payment confirmation forgery?
Sites using the plugin through version 1.2.10 are exposed when the payment-notification validation secret remains empty, which is the default configuration.
What does an attacker need to exploit this issue?
An attacker does not need to authenticate. They can forge a payment notification that is accepted as valid and use it to mark an order as paid.
How can administrators determine whether their site is affected?
Check whether the site uses Payex Payment Gateway for WooCommerce version 1.2.10 or earlier and whether its validation secret is unset or empty.
What can be done if an update cannot be applied immediately?
Set a non-empty validation secret for payment notifications, and review orders marked paid for unexpected or forged payment confirmations.